Overview
- Security teams at Calif and Wiz using AI under a coordinated program with the PHP Foundation and OpenAI discovered two critical remote code execution vulnerabilities that had gone unnoticed for more than a decade.
- The PHP maintainers published security updates Thursday and the bugs were scored as critical with a CVSS around 9.2, meaning attackers could run arbitrary code, access databases, install malware, or take full control of servers.
- CERTs and national agencies including the NSA, UK NCSC and CERT-EU issued emergency guidance that urges immediate patching or temporary disconnection of exposed services when updates are impractical.
- Defenders are already seeing exploitation attempts and large-scale probing on major networks, with Cloudflare and other providers reporting rapid spikes in attack traffic and many governments and sites taken offline as a precaution.
- Widespread use of PHP across WordPress, Drupal and other platforms plus many legacy, unmaintained installations means remediation will be slow, raising risks to payroll, financial and other sensitive data and prompting calls for incident-response support and sustained investment in secure maintenance.