![[Imen Ben Youssef / Hans Lucas / Hans Lucas via AFP]](/cdn-cgi/image/onerror=redirect,width=640,height=640,format=webp/https://storage.googleapis.com/uploads.mongoosehq.com/url/media/191340522/f08feb06e511a46b58055da0d01669aea0225ac06924052f7aad3ee8738b737c)
Overview
- The PHP project released emergency security updates on Wednesday, October 21st, issuing fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urging immediate updates.
- National cyber agencies and large operators took many public sites offline as a precaution, with French prefectures, tax and weather services and government portals in the Netherlands and Finland placed into maintenance.
- Security firms and agencies reported early exploitation attempts, and they say the highest residual risk is on older, unpatched PHP installs and small sites on shared hosting that may take longer to remediate.
- Two security teams using large AI models, including firms named Calif and Wiz, found the bugs during code audits and coordinated fixes with the PHP project, a process that also shortens the window before attackers can weaponize details.
- Authorities recommend immediate patching to the published versions, isolating or taking vulnerable hosts offline and using out-of-band channels for urgent public services, while smaller sites and third-party hosts remain the key weak points to watch.