Developers are releasing a security patch for the PHP programming language to address two critical vulnerabilities. These flaws have been assigned a severity score of 9.2 out of 10, indicating a high level of risk for web infrastructure.
According to security firm watchTowr, the vulnerabilities allow for remote code execution and affect all PHP versions starting from PHP 5. Experts estimate that over 1.3 million internet-connected hosts are potentially at risk.
The issue impacts a significant portion of the web, as WordPress reports that over 40% of websites utilize its platform, all of which rely on PHP. Security providers note that the patch cannot be applied automatically and requires manual installation by site administrators.
Organizations including the EU CERT and the UK National Cyber Security Centre have issued guidance recommending that companies isolate or temporarily disable internet-facing applications if immediate patching is not possible. GrapheneOS has already taken its user forum offline as a precautionary measure.
