Overview
- Security teams at Calif and Wiz used artificial intelligence as part of a Patch the Planet effort to find two serious vulnerabilities in PHP that remained unnoticed for more than a decade.
- Both flaws allow remote code execution, which lets an attacker run arbitrary programs on an affected server and can lead to data theft, site defacement, malware installs, or full server takeover.
- The PHP project has published patches that fix the defects and cyber authorities including the NSA, NCSC and CERT-EU have issued emergency advisories urging immediate updates or temporary takedowns for sites that cannot be patched quickly.
- Security firms such as Cloudflare reported early exploit attempts and many public institutions took websites offline as a precaution while administrators apply fixes and verify compatibility.
- Widespread legacy deployments and customized stacks — some possibly dating back to PHP 5 — make full remediation slow and raise the risk of prolonged exposure across content management systems, shared hosting and embedded web services.