PHP releases fixes for two critical flaws after European websites are taken down
PHP released fixes for two critical vulnerabilities that could allow attackers to run code on website servers without logging in. The Search Engine Journal report says Apache servers using mod_php face the highest risk, while PHP says all installations serving website requests are at risk.
AI-assisted synthesis · Based on 4 independent reports from 5 outlets · Article text read from 1 of 4 reportsHow it's made
View timeline · 4 entriesWhat happened
Key facts
- Search Engine Journal reports that PHP released fixes for two critical flaws that can allow attackers to run code on website servers without logging in.
- Search Engine Journal says the emergency update was scheduled for October 21 at 14:00 UTC and that the fixes were available (per searchenginejournal.com).
The brief
PHP has released fixes for two critical flaws that could let an attacker run code on a website server without logging in, Search Engine Journal reported. Headlines from the BBC, twaslnews1.twaslnews.com and en.vijesti.me separately describe websites, including government websites, being taken down across Europe.
The Search Engine Journal account does not connect those takedowns to a particular actor or describe how many sites were affected. The fixes cover PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Search Engine Journal says the emergency update was scheduled for October 21 at 14:00 UTC and that the fixes were available.
The account characterizes the vulnerabilities as critical and says they could enable code execution without an attacker logging in. The risk differs by server setup, according to the report. Apache servers running mod_php face the highest risk, while PHP says every installation serving website requests is at risk.
The account does not give technical details about how the flaws are exploited or identify a particular affected site. PHP 8.1 and older versions are listed as end-of-life and no longer receive regular official updates. For this emergency, PHP also supplied limited source-code fixes for versions 7.4, 8.0 and 8.1, intended for teams that build PHP themselves.
Those source-code fixes are distinct from the listed fixed releases. The report advises users of PHP 8.1 or older to back up their sites and arrange an upgrade. It does not specify an upgrade deadline or name a particular upgrade target.
The headlines from the BBC and twaslnews1.twaslnews.com describe websites taken down across Europe ahead of a critical cyber-security update; en.vijesti.me specifies government websites and describes serious security breaches. The National Cyber Security Centre headline identifies a critical security issue affecting PHP.
The reported fixes and the advice for older installations are the concrete technical details available in the account. For operators, the stated distinction is between installing one of the fixed releases and, for teams building older versions themselves, using the limited source-code fixes. The account provides no further operational detail about the European takedowns.
Why it matters
- PHP installations serving website requests are at risk according to PHP, with Apache servers using mod_php identified as facing the highest risk.
- The two flaws could allow unauthenticated code execution on website servers, the mechanism described by Search Engine Journal.
- Teams using PHP 8.1 or earlier face an end-of-life constraint: regular official updates are no longer provided, although limited source-code fixes were supplied for versions 7.4, 8.0 and 8.1 for teams building PHP themselves.
What to watch next
- Whether operators move to one of the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Whether teams building PHP 7.4, 8.0 or 8.1 use the limited source-code fixes provided for this emergency.
- Whether operators using PHP 8.1 or older back up their sites and arrange an upgrade, as the report advises.
How it's being covered
Coverage analysisShow details5 source articles · 5 unique outlets · 4 distinct reportsOutlet political mix: Too few rated· 2 Center · 3 unratedWhere the outlets are based: Unknown 60% · Europe 40%
How outlets' accounts compare
Timeline
Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.- Rasmus Lerdorf created the tools that became PHP.Background · compiled and fact-checked by Updat3
- PHP released version 3, which established the language’s modern form.Background · compiled and fact-checked by Updat3
- PHP 5, released in 2004, helped extend its use in building dynamic websites.Background · from our historical context
- PHP maintainers issued fixes for CVE-2024-4577, a critical argument-injection flaw affecting PHP in CGI mode on Windows.Background · compiled and fact-checked by Updat3
How we got here
In June 2024, PHP maintainers issued fixes for CVE-2024-4577, a critical argument-injection vulnerability affecting PHP running in CGI mode on Windows; the flaw could permit remote code execution under certain configurations. The policy makes the PHP branch and version installed on a server important factors in whether it receives security patches.
PHP began in 1994 as a set of tools created by Rasmus Lerdorf, and PHP 3, released in 1998, established the language’s modern form. PHP 5, released in 2004, helped extend its use in building dynamic websites.
Original sources
5 articles from 5 outletsEvery story links to the reporting it was built from. How we choose sources
Spotted a factual error, a broken link or a misleading summary? Tell us.