The PHP Foundation has officially acknowledged a structural failure that led to significant delays in addressing a critical security vulnerability. The flaw, which was initially identified in 2024, remained unpatched due to a combination of internal decision-making processes and a shortage of core developers with the necessary expertise.
The issue gained urgency on August 11 after independent reports from OpenAI and the security firm Calif confirmed the risk of remote code execution. In response, the foundation released emergency patches for two critical vulnerabilities that could allow unauthenticated attackers to gain control over affected servers.
The disclosure triggered widespread precautionary shutdowns of government and public services globally, including infrastructure in the Netherlands, Finland, France, Germany, and Australia. Organizations such as the Wikimedia Foundation also took supporting services offline to mitigate potential risks during the patching process.
The impact extended to the blockchain sector, where firms like SlowMist urged exchanges and DeFi platforms to audit their systems. SlowMist reported identifying 793 domains with PHP fingerprints among 1,488 assessed. Meanwhile, companies like Coinbase and BitGo confirmed they were unaffected by the vulnerability.
To assist with remediation, OpenAI has published a tool on GitHub designed to help operators scan for vulnerable PHP versions. While the PHP security team stated that no functional exploits have been identified to date, industry leaders like Binance co-founder Changpeng Zhao have advised users to exercise caution.
