01
Security
Two critical PHP flaws leaked early after embargo broken
Affected sites had less time to patch than planned, adding pressure to how quickly maintainers can respond to AI-found bugs.
Affected sites had less time to patch than planned, adding pressure to how quickly maintainers can respond to AI-found bugs.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Millions of exploit attempts have been logged, but it is unclear whether any attack has succeeded, and only the latest PHP release carries the fix.
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
Operators running PHP 8.1 or older face the most pressing risk, since no official fix is coming for those versions.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.