IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
Patching is slow for sites on older PHP versions, and an early warning of a working exploit was withdrawn.
A critical PHP vulnerability prompted a scramble among IT staff, who said the past two days had been relentless. Administrators reported juggling client requests to take sites offline with coordinating patches across many setups, and some found that older PHP versions still in use would need rebuilt web applications or code changes. The PHP Foundation released its fix at 15:00 BST on Wednesday, and experts said unverified rumours of active attacks were circulating. One major security firm issued a warning that a working proof-of-concept existed, then withdrew it. Despite warnings about millions of hourly hacking attempts, no large-scale breaches have been confirmed, though some experts worry about alert fatigue as AI tools surface more flaws.
Why it matters
For people who follow the web, the episode shows how a critical flaw in widely used server software can land on administrators at once, with little time to act. No large-scale breach has been confirmed so far. Some experts worry that a steady flow of AI-found flaws may leave people less responsive to each new alert.
Series Critical PHP flaws
- IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
- Two critical PHP flaws leaked early after embargo broken
- PHP flaws prompt urgent patching across the web as attack attempts climb
- Attacks on PHP2Shell flaws began four days before patches shipped, Amazon says
- PHP Flaws Prompt Precautionary Site Takedowns Worldwide
- Two critical PHP flaws found with AI tooling prompt patched releases
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.