PHP Foundation acknowledges delayed fix as emergency patches address critical flaws

The PHP Foundation acknowledged that indecision and a shortage of resources delayed a critical security fix, describing the stalled work as a “structural failure.” Separately, The Hacker News headline says PHP issued emergency patches for two critical PHP2Shell remote-code-execution flaws as exploit attempts emerged.

Cointelegraph reported that government websites and online services were disrupted amid concern that attackers could take control of vulnerable servers. The foundation’s account, as reported by Cointelegraph, traces the vulnerability to signs developers first found in 2024. They struggled to devise a fix that would avoid disrupting software built using PHP, the outlet said.

The foundation was directed to the vulnerability again on August 11, after security firm Calif and OpenAI independently reported the same underlying issue. Cointelegraph said Calif demonstrated unconditional remote code execution, a capability that elevated the issue to a top security priority.

The outlet also reported that an assessment identified 793 domains with direct PHP fingerprints among 1,488 domains examined. Those figures describe domains with a PHP fingerprint in the assessment; they do not, by themselves, establish how many were compromised. The PHP Foundation’s acknowledgement places the delay and its stated resource shortage at the center of the account.

The Hacker News headline identifies the patch release as addressing two critical PHP2Shell flaws and says exploit attempts had emerged. Cointelegraph reported disruption to government websites and online services, but did not specify which governments or services were affected or quantify the disruption.

Cointelegraph also reported that Binance co-founder Changpeng Zhao urged internet users on Wednesday to be “extra careful” when visiting websites in the next few days. Zhao’s stated reason was that some web administrators might not yet have applied security patches. His warning points to the patch-installation status of individual websites as an immediate concern.

The reported sequence is that developers found signs of the flaw in 2024, the foundation received renewed attention to it on August 11, and emergency patches were subsequently issued. The account does not give a calendar date for those events or identify the affected websites.

The foundation’s explanation centers on its difficulty finding a fix compatible with software built on PHP, alongside the delay it attributed to indecision and limited resources.