PHP exposes serious security vulnerability, global website operators urgently enter patching state

According to the security bulletin released by the PHP development team, the severity score of the two vulnerabilities is 9.2 points, using the CVSS v4.0 vulnerability scoring system with a full score of 10 points. The development team asks all PHP users to prepare in advance and upgrade as soon as a fix is ​​released. The announcement also stated that if the details of the vulnerability are disclosed in advance, or if the vulnerability is found to be actually exploited, the patch may be released in advance.

PHP is the most widely used server-side programming language in the Internet infrastructure. Many websites rely on it to generate web pages, handle user requests, connect to databases, and perform background business logic. Mainstream content management systems and e-commerce platforms, including WordPress, Drupal, Joomla and Magento, all use PHP extensively. Therefore, the potential impact of this vulnerability is not limited to a certain piece of software or a certain type of website, but may affect a large number of Internet services.

Among these, the scope of WordPress’ influence is particularly noteworthy. Data released by WordPress last year showed that the platform supports more than 40% of the world’s websites. Cybersecurity company Wordfence points out that WordPress websites often run on servers with PHP installed, so as long as there are unpatched vulnerabilities in the underlying PHP environment, the relevant websites may be at risk.

Security researchers estimate that the number of potentially affected Internet hosts exceeds 1.3 million. However, this number is a preliminary estimate by the researchers and does not mean that all relevant hosts have been compromised, nor can it be concluded that all websites will necessarily be affected to the same extent.

Remote code execution vulnerabilities are dangerous because an attacker could send specially crafted requests to a vulnerable server over the network to execute malicious code without requiring a legitimate account or login credentials. Once the attack is successful, the consequences may include tampering with website pages, stealing data on the server, implanting malicious programs, and even further controlling the entire server. For websites that store user profiles, customer information or transaction records, a breach could also lead to wider data breaches and business disruption.

Security research organization watchTowr stated that based on the relevant information currently leaked, these two vulnerabilities may affect multiple versions starting from PHP 5. However, before PHP officially fully discloses the details of the vulnerability and the list of affected versions, the specific scope of impact still needs to be subject to official announcements.

To make things even trickier, webmasters can’t just rely on WordPress’s auto-update feature to solve the problem. Wordfence specifically reminds that this time the vulnerability exists in PHP itself, not in the WordPress core program or a plug-in. So even if a website has automatically updated WordPress core and plugins, the PHP environment that the server is actually running on may still need to be upgraded separately.

For users using virtual hosting, PHP is usually maintained by the hosting provider; if the website is running on a self-managed virtual private server, cloud server, or independent server, the maintenance responsibility may fall on the website owner or system administrator. Website operators need to confirm the PHP version currently in use, who manages the server, and whether the service provider will deploy a repair version in a timely manner.

The European Cybersecurity Emergency Response Team (CERT-EU) and the UK National Cyber ​​Security Center have both issued warnings, recommending that organizations that cannot complete the repair immediately should temporarily isolate Internet-facing applications from the public network, or directly take relevant websites offline until the vulnerability is effectively mitigated. The EU specifically pointed out that the vulnerability may allow attackers to execute malicious code without logging into the system, so organizations should identify affected assets in advance and prepare for emergency updates.

Some institutions have already taken preventive measures. The development team of mobile operating system GrapheneOS said it has temporarily closed its user discussion forum to avoid taking unnecessary risks as proof-of-concept attack code for the vulnerability is under development. PHP developer Gina Peter Bagyard also said that installing patches is the key to solving the problem; if it cannot be repaired in time, shutting down the server may be a safer choice.

Cybersecurity researchers also warned that after the patch is released, attackers may quickly analyze the code differences before and after the patch, find out how to exploit the vulnerability, and launch large-scale attacks on servers that have not been updated. Security research organization Sansec predicts that large-scale attacks may occur within just 15 minutes after the patch is made public. This prediction does not mean that an attack will definitely occur within this timeframe, but it reflects the security industry's concerns about the rapid expansion of risks after the vulnerability is made public.

Meanwhile, Cloudflare Chief Technology Officer Dane Knecht said the platform has observed early signs of attacks targeting websites running PHP. Cloudflare is temporarily adjusting firewall rules to provide additional protection until an official patch is released. However, he emphasized that these measures can only be used as a transitional solution and cannot replace formal repairs.

The Australian Cyber ​​Security Center stated that no confirmed exploitation activities related to these two vulnerabilities had been discovered at that time, and recommended that organizations take inventory of systems running PHP internally as soon as possible, prepare patches in advance, and continuously monitor applications for abnormalities. Different security agencies have different statements about attack situations, which means that threat intelligence is still changing rapidly, and website operators should not assume that their systems are safe just because large-scale attacks have not yet been confirmed.

For ordinary website owners, the most important lesson from this incident is that website security not only depends on whether the content management system and plug-ins are kept up to date, but also depends on whether the underlying operating environment of the server is maintained in a timely manner. Even if a website rarely updates content, as long as services are still provided over the Internet, serious vulnerabilities in the underlying software may become entry points for attacks.

PHP officially plans to release a repaired version at 14:00 UTC on October 21, 2026, corresponding to 22:00 Beijing time. The development team stated that it will further announce the vulnerability details, affected versions and repaired version information at that time. Website administrators should confirm as soon as possible after the official update is released whether the service provider or their own server has completed the repair, and check system logs and abnormal activities if necessary.

As the PHP patch is about to be released, a large number of websites around the world will enter the emergency maintenance stage. The risk of this incident comes not only from the vulnerability itself, but also from the large number of old version servers on the Internet, and the reality that website owners may not be able to complete updates in time. For critical systems that cannot be repaired immediately and are directly exposed to the Internet, it may be safer to temporarily restrict access or take them offline than to continue to run the risk.

Learn more:

https://www.php.net/index.php