Skip to content
Sign in
Technology · Global

PHP developers prepare fixes for two critical flaws

PHP developers are preparing fixes for two critical vulnerabilities. PHP 8.4.0, released Nov. 21, 2024, was the latest major release before the flaws; the project’s policy provides two years of bug fixes, followed by two years of security fixes.

AI-assisted synthesis · Based on 2 outlets' reporting · Article text read from 1 of 2 outletsHow it's made

View timeline · 8 entries
2 outlets2 regionsLatest reporting 2 min readNo new reporting in 4 days
Coverage: Too few ratedL 0 · C 1 · R 0 · 1 unrated

What happened

Key facts

  • PHP developers said an advisory published on Tuesday described two vulnerabilities with a severity rating of 9.2 out of 10 (per The Verge).
  • PHP developers said they might release the patch earlier if vulnerability details became public or they found evidence of active exploitation (per The Verge).
  • PHP developers urged users to upgrade as soon as the release became available (per The Verge).
  • Cybersecurity firm watchTowr said the flaws reportedly affect every PHP version from PHP 5 onward (per The Verge).

The brief

PHP developers are preparing patches for two vulnerabilities rated 9.2 out of 10, with the flaws potentially allowing attackers to run code on affected servers. The Verge reported that developers expected the fixes to be released at 10AM ET on the day of its report. The article does not give a calendar date for that expected release.

The developers said they might publish the patch sooner if details of the vulnerabilities became public or they found evidence that attackers were exploiting them. They urged PHP users to upgrade as soon as the release became available. Those statements set out the developers’ release conditions and guidance; they do not establish that exploitation was already occurring.

Cybersecurity firm watchTowr described the vulnerabilities as Remote Code Execution exploits and said they reportedly affect every PHP version from PHP 5 onward. Such flaws could allow an attacker to run their own code on an affected server. The Verge said attackers could then use that access to alter websites or steal data, among other possible actions.

The potential reach extends to websites built on WordPress. Wordfence warned that every WordPress site would be vulnerable because those sites run on servers using PHP. The Verge noted that WordPress reported last year that its software powered more than 40 percent of the internet, illustrating the scale of sites implicated by Wordfence’s warning.

The article does not provide a count of affected sites. Cybersecurity agencies encouraged websites that could not install the fix promptly to take their systems offline temporarily. That guidance presents a precaution for operators unable to patch at once; the article does not identify the agencies or specify how long a site might need to remain offline.

The immediate decision for PHP users is whether they can apply the patch when developers release it. For site operators unable to do so promptly, the agencies’ stated advice is to take systems offline temporarily.

The Verge’s account gives no further deployment schedule beyond the expected release time and the possibility of an earlier release under the conditions described by the developers.

Why it matters

  • Because the flaws reportedly affect every PHP version from PHP 5 onward and could allow attackers to run code on vulnerable servers, organizations that rely on PHP face potential compromise of their systems and data. The patches will give administrators a concrete way to address the risk, but they will need to upgrade promptly once fixes are released.

What to watch next

  • Whether PHP developers release the patch at the expected 10AM ET time or earlier.
  • Whether vulnerability details become public, one condition developers cited for an earlier release.
  • Whether developers find evidence of active exploitation, another condition they cited for releasing the patch early.
  • Whether PHP users upgrade once the patch becomes available, as developers urged.

How it's being covered

Coverage analysisShow details
2 source articles · 2 unique outlets
Outlet political mix: Too few rated· 1 Center · 1 unrated
Where the outlets are based: US/Canada 50% · Asia 50%
Outlet political mix
Too few rated
Left
Center
Right
0 outlets
1 outlet
0 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
2 unique outletsDominant coverage: US/Canada
Limited coverage
  • Coverage is currently limited to 2 outlets.
How we measure coverage

How outlets' accounts compare

Updat3 does not yet have enough full reports to compare how outlets framed this story.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. PHP began in 1994, when Rasmus Lerdorf created tools for tracking visits to his online résumé.
    Background · from our historical context
  2. PHP released version 3, which established the language’s modern form.
    Background · compiled and fact-checked by Updat3
  3. PHP released version 5, which extended its use in building dynamic websites.
    Background · compiled and fact-checked by Updat3
  4. PHP 5, released on July 13, 2004, introduced the Zend Engine 2 and expanded object-oriented programming support.
    Background · from our historical context
  5. PHP released version 7.0.
    Background · compiled and fact-checked by Updat3
  6. PHP released version 8.0.
    Background · compiled and fact-checked by Updat3
  7. PHP maintainers issued fixes for CVE-2024-4577, a critical argument-injection flaw affecting PHP in CGI mode on Windows.
    Background · compiled and fact-checked by Updat3
  8. PHP released version 8.4.0.
    Background · compiled and fact-checked by Updat3

How we got here

PHP 8.4.0, released on November 21, 2024, was the latest major PHP release before the vulnerabilities at issue; PHP’s release policy provides bug fixes for two years after a stable release, followed by two years of security fixes. PHP began in 1994, when Rasmus Lerdorf created tools for tracking visits to his online résumé.

In 1995, he released the code as Personal Home Page Tools, and PHP 3, released in 1998, established the language’s modern foundation. PHP 5, released on July 13, 2004, introduced the Zend Engine 2 and expanded object-oriented programming support. PHP 7.0 followed on December 3, 2015, and PHP 8.0 on November 26, 2020.

Related developments1 story

Original sources

1 of 2 articles · Asia · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.