01
Security
PHP flaws prompt urgent patching across the web as attack attempts climb
Organisations are still checking exposure, and experts warn the fallout may take months to fully emerge.
Organisations are still checking exposure, and experts warn the fallout may take months to fully emerge.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Sites running PHP may need to take systems offline until fixes are applied, as attackers were already probing the weaknesses before the public warning.
Operators running PHP 8.1 or older face the most pressing risk, since no official fix is coming for those versions.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.
The app is moving beyond custom feeds, with creations tied to AT Protocol and private data support and payments on the way.
Artifex has patched the flaw, but operators still need to check what version is actually running.
The seizure cuts off infrastructure used to scan and break into targets, while a joint advisory gives defenders indicators and steps to check for compromise.
A CSRF flaw in Elementor’s Editor Events module is patched in version 4.3.2, and users are urged to upgrade quickly.
A Red Heron–linked actor used fresh WordPress and ZyXEL bugs to raid government and small-business systems worldwide for credentials and personal data.
Admins on unpatched sites can be tricked into installing themes that execute PHP, exposing files, data and accounts.