01
Security
IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
Patching is slow for sites on older PHP versions, and an early warning of a working exploit was withdrawn.
Patching is slow for sites on older PHP versions, and an early warning of a working exploit was withdrawn.
Affected sites had less time to patch than planned, adding pressure to how quickly maintainers can respond to AI-found bugs.
Organisations are still checking exposure, and experts warn the fallout may take months to fully emerge.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Railway has paused deployments and begun restoring builds, starting with Pro and Enterprise workspaces, while it investigates the incident.
Millions of exploit attempts have been logged, but it is unclear whether any attack has succeeded, and only the latest PHP release carries the fix.
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
Sites running PHP may need to take systems offline until fixes are applied, as attackers were already probing the weaknesses before the public warning.
Operators running PHP 8.1 or older face the most pressing risk, since no official fix is coming for those versions.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.