Critical PHP Vulnerabilities Threaten Over 40% of Internet-Connected Websites
PHP developers are releasing urgent security patches to address two critical Remote Code Execution (RCE) vulnerabilities with a severity rating of 9.2/10. The flaws affect all versions from PHP 5 onward, potentially allowing attackers to execute malicious code, steal data, and alter websites. Because WordPress powers over 40% of the internet via PHP-based servers, the scope of the risk is massive, affecting an estimated 1.3 million hosts. Cybersecurity agencies, including the UK National Cyber Security Centre and the EU Computer Emergency Response Team, have advised organizations to isolate or take systems offline if they cannot patch immediately. Major players like Cloudflare are implementing firewall rule updates as a temporary stopgap, while others, such as GrapheneOS, have already taken services offline due to emerging proof-of-concept exploits.
Topics: PHP vulnerability Remote Code Execution Software Patch Web Security
Read the full article at The Verge
Part of the story Critical PHP Vulnerabilities Threaten Global Web Infrastructure and Legacy Services (3 articles)