PHP Exposed to Severe Security Vulnerabilities, Numerous Websites Proactively Taken Offline
An AI model and a cybersecurity researcher simultaneously discovered major security vulnerabilities in PHP in mid-August; exploiting the two vulnerabilities in combination allows attackers to directly access the file system or database behind a website. Disclosure of the vulnerabilities was delayed until this week, but not all websites have installed the patches; AWS says these vulnerabilities are being "widely exploited," and the NSA recommends that unpatched websites be taken offline first. As a result, a large number of commercial and government websites have gone offline, and 9to5Mac and its sister sites say they are already protected.
Why read this
AI score 81
The article outlines how two PHP vulnerabilities were exploited in combination and how the lack of widespread patching led many websites to proactively go offline, and provides the NSA's remediation recommendations.
Topics
Body
A significant number of websites have gone offline, and that’s not due to a service outage, but rather a deliberate decision by the site’s owners.
The reason is because extremely dangerous security vulnerabilities have been found in a protocol used by most websites – PHP. This issue is unrelated to the separate vulnerability discovered in web certificates …
What is PHP?
PHP is one of the weirder acronyms around. While it originally stood for Personal Home Page, it’s now more usually defined as the recursive “PHP: Hypertext Preprocessor.”
PHP is an open-source, general-purpose scripting language, very well suited to web development and able to be embedded into HTML. It’s used by around 70% of all websites.
What happened?
AI models and a cybersecurity researcher simultaneously discovered a major security flaw in PHP in mid-August. A combination of two vulnerabilities allowed an exploit which could give an attacker direct access to the underlying file system or database behind a website. That could expose a vast amount of personal data.
To allow time for the problem to be patched by the PHP Foundation, disclosure of the vulnerabilities was embargoed until this week (though it leaked two days ahead of the embargo). However, not every website has been able to apply the patch as yet, and Amazon Web Services said that the vulnerabilities are being “broadly exploited” across the internet.
The problem is so serious that the NSA has advised that unpatched sites be taken offline until the problem is fixed.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…— NSA Cyber (@NSACyber) October 21, 2026
For that reason, a great many commercial and government websites have been taken offline until PHP can be updated on their servers.
I’m happy to be able to confirm that 9to5Mac and its sister sites are already protected.
iPhone Duo cases
Beats Woven USB-C cables