Overview
- Developers disclosed two critical PHP vulnerabilities that allow remote attackers to run code on servers, a problem first revealed and widely publicized on Wednesday, October 21.
- Hundreds of sites across municipalities, safety regions, hospitals, media outlets and small businesses were taken offline as a precaution, with NotuBiz cutting council information systems for about twenty municipalities to block attacks.
- The PHP Foundation published an official patch at about 16:00 on Wednesday, October 21, and many administrators have applied it and restored services but recovery has been uneven and some sites remain offline.
- The PHP Foundation acknowledged a procedural failure in its security decision making and said resource and process problems delayed the response, prompting official scrutiny and calls for process reform.
- Cybersecurity experts and authorities warn the fallout could last months because a patch fixes the code flaw but cannot undo any earlier breaches and many operators, especially small or outdated systems, may not update promptly.