Particle.news
Get it on Google Play
Download on the App Store
17 ARTICLES
·
6h ago

Critical PHP Flaws Prompt Emergency Patches and Widespread Precautionary Site Shutdowns

Authorities urge immediate patching or temporary isolation to prevent unauthenticated remote code execution.

El sitio web de The PHP Foundation se ha actualizado a la versión más reciente de PHP. Una vulnerabilidad de seguridad grave, recién descubierta, está comprometiendo los cimientos de numerosos sitios web y servicios en línea en todo el mundo
La alerta de seguridad llevó a distintas organizaciones a suspender temporalmente el acceso público a sus páginas mientras preparaban la actualización de sus sistemas. La medida buscaba reducir el riesgo de intrusiones antes de instalar los parches. Foto: Pexels.
1. Qué pasó con las páginas web de varios gobiernos y cuál es el riesgo de las fallas en PHP.
Alerta informática en la UB.

Overview

  • The PHP project published emergency fixes for maintained branches — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — after two critical vulnerabilities were disclosed.
  • Security agencies including the U.S. NSA and CERT‑EU warned that administrators must apply the updates or take exposed services offline, a warning that led many European governments to pull public sites as a precaution.
  • Researchers at Calif and OpenAI first reported the issues in August and the cloud security firm Wiz later expanded the findings, all of which were identified with AI-assisted tools before a pre-release leak accelerated the emergency response.
  • Infrastructure providers and vendors such as Cloudflare reported early exploitation attempts after patches were published, and many organizations remain in the process of patching and scanning for compromise.
  • The flaws are especially urgent because PHP runs on roughly 70–75% of sites where server language is identifiable, small sites on shared hosting and servers on unsupported PHP releases face the biggest operational risk and may remain exposed longer.