PHP Flaws Prompt Precautionary Site Takedowns Worldwide
Millions of exploit attempts have been logged, but it is unclear whether any attack has succeeded, and only the latest PHP release carries the fix.
A set of weaknesses in PHP, the programming language behind millions of websites, has been found, prompting precautionary takedowns of sites worldwide even though no successful attack has been reported. The flaws were reportedly located with help from AI tools, and the PHP Foundation issued a fix after the disclosure was leaked before sites could be patched. Large web firms such as Cloudflare and Palo Alto Networks say they have seen millions of attempts to exploit the flaws, though it is unclear whether any have succeeded. The patch applies only to the latest PHP release, so operators running older versions must upgrade first, which may be a substantial task for many sites.
Why it matters
For the many websites built on PHP, the practical effect is that a fix exists but reaches only sites already running the newest release. Operators on older versions must upgrade before they can be protected, which may take real effort and leaves them exposed in the meantime. Because the disclosure leaked before patches were in place, sites had less time to prepare, and some have chosen to take themselves offline as a precaution.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BBC Technology