Critical PHP flaws could expose servers to code execution attacks

PHP developers are preparing patches for two critical vulnerabilities that could let attackers run code on affected servers. The flaw could allow websites to be altered or data stolen, and security agencies advise organisations that cannot patch promptly to isolate internet-facing systems or take them offline.

The vulnerabilities reportedly affect every PHP version from 5 onwards and carry a severity rating of 9.2 out of 10; one researcher estimates more than 1.3 million internet-connected hosts may be affected. WordPress sites are also at risk, and the fix must be applied manually rather than through automatic updates. The patch is expected at 10am ET, while Cloudflare reports early attacks and researchers warn that wider attacks could follow its release.