Key facts
- PHP Foundation cited indecision and resource shortages for the delay.
- The vulnerability could allow unauthenticated attackers to execute code on servers.
- Emergency patches were released for two critical vulnerabilities.
- Several governments and organizations took websites offline as a precaution.
The PHP Foundation has admitted that a "structural failure" involving indecision and a shortage of resources delayed the release of a critical security fix for a flaw first identified in 2024. The foundation acknowledged that the decision process caused work on a fix to stall and restart repeatedly over months.
Government agencies and organizations worldwide took websites offline on Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in. PHP is a programming language widely used to power websites and web applications.
On August 11, the foundation was alerted to the vulnerability again after security firm Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution. This made the issue a top security priority.
Several countries experienced disruptions, including the Netherlands, which shut its digital identity service and took its National Cyber Security Center website offline. Finland's state IT provider Valtori disconnected government public web services, while France's Interior Ministry temporarily took prefecture websites offline. Germany's federal IT provider ITZBund also disabled several websites. In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website was among those affected.
Japanese Prime Minister Sanae Takaichi urged website operators to prepare to apply the patch as quickly as possible, suggesting temporary suspension of website functions could reduce risk if immediate patching was not possible. The Wikimedia Foundation took some supporting services offline, and Intersect temporarily took its Members Area offline.
Cryptocurrency exchanges Coinbase and BitGo reported no evidence of exposed PHP instances. However, Binance co-founder Changpeng Zhao warned internet users to be extra careful visiting websites in the coming days due to potential delays in security patch application.