Overview
- Independent researchers disclosed two critical PHP vulnerabilities on Wednesday that permit remote code execution and could let attackers run arbitrary commands on affected web servers.
- Cloudflare and security firms reported attack attempts surged from thousands to millions within hours after technical details became public, creating a race to patch vulnerable systems.
- The PHP Foundation released emergency updates on 21 October and hosting providers applied them under pressure so many websites and services were taken offline briefly and most were restored after updates.
- Germany’s BSI warned the flaws can affect not only websites but also web‑facing appliances such as routers, load balancers and NAS devices and urged continued checks even though authorities report no confirmed major breaches so far.
- The incident has intensified political calls to strengthen centralized vulnerability management and incident response while highlighting AI’s dual role in speeding both vulnerability discovery and exploit development.