The PHP Foundation has acknowledged that indecision and a lack of resources delayed fixing a critical security flaw first identified in 2024, calling the stalled response a “structural failure”.
Government agencies and other organizations around the world took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. These flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
PHP is a programming language widely used to power websites and web applications, including content management systems.
In a blog post The following After the patch was released, the foundation explained how its developers first found signs of the vulnerability in 2024, but struggled to come up with a fix without disrupting the larger ecosystem of software built using PHP.
“Combined with a small team of core developers with a small team of core developers with the necessary deep knowledge of the engine associated with the lack of a known path for remote code execution and many responsibilities, this decision process caused work on a fix to stop and restart repeatedly over several months,” the foundation said.
“We will not pretend otherwise: the delay was a structural failure, due to the security team’s decision-making process and its lack of resources.”
The foundation was alerted to the vulnerability again on August 11, when security firms Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution, making it a top security priority.
Websites Go Dark Amid PHP Security Fears
The disruption spread across the globe as developers took down websites while preparing to install an emergency fix.
The Netherlands shut down its digital identity service, and the country’s National Cyber Security Center also took its website offline.
Finland’s state IT provider Valtori shut down government public web services, while France’s interior ministry temporarily took prefecture websites offline. Also Germany’s federal IT provider ITZBund disabled According to Reuters, several websites.
In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among the government sites affected by the PHP issue.
Japanese Prime Minister Sanae Takaichi contacted X to urge website operators to prepare to apply the patch as soon as possible. In one Postit said temporarily suspending website functions could reduce the risk if a patch could not be applied immediately.
The Wikimedia Foundation, which runs Wikipedia, said it had hired some support services. Offline As a precaution, including Toolforge and Cloud VPS, which host tools and projects used by volunteer developers, some parts of Wikipedia went offline on Wednesday.
Blockchain security firm SlowMist said its MistEye service Surveyed The use of PHP in the crypto industry urges exchanges, DeFi platforms and wallet providers to review their exposure and upgrade. It identified 793 domains with direct PHP fingerprints out of 1,488 domains.
Intersect, a membership organization that supports the development and governance of the Cardano blockchain, said It had taken its members’ area temporarily offline while it assessed potential exposure. The page is still offline at the time of writing.
Related: Tech companies rush to block 8 eMudhra certificates that can enable fake sites.
Coinbase Chief Security Officer Jeff Longelhofer said The company found no evidence of any exposed PHP instances.
“Whenever we hear about threats like this, we automatically do a full sweep to make sure everything is as secure as we can make it. We’re also working with our third-party suppliers for added reassurance.”
Digital asset infrastructure company BitGo also said it had a platform Unaffected From PHP Vulnerability.
Meanwhile, Binance co-founder Changpeng Zhao warned Internet users on Wednesday should be “extra cautious” about visiting any websites over the next few days, as some web administrators may not be up to date with security patches.
OpenAI has released a codex skill to help website operators check for potentially vulnerable PHP versions and identify applicable updates, which Accessed via GitHub.
PHP’s security team said it had not identified any active exploits at the time of its public disclosure.
Magazine: 5 Ledger Alternatives to Store Your Bitcoin
