All known PHP versions back to PHP 5 are affected, remote code execution is possible. Developers released patches on October 21 at 4pm German time.
Germany's Federal Office for Information Security, the BSI, has warned of critical flaws in the PHP programming language that affect web applications worldwide. According to current findings, all known PHP versions back to at least PHP 5 are vulnerable. Attackers could use the flaws to run malicious code remotely on web servers running PHP applications. Developers released patches for the affected versions on October 21 at 4pm German time.
PHP forms a core building block of many web applications, including backends for AI services. BSI vice president Thomas Caspers considers large scale exploitation within hours of the patch release likely, since attackers can use AI powered tools to quickly build matching exploits. That shrinks the window companies have to react once such a warning goes out.
Organizations running PHP web servers should have staff ready at release time to install the patches immediately and verify patch status against the advisory. It remains unclear how many operators worldwide will react in time before the first wave of attacks hits. Anyone running exposed servers should watch them closely for unusual activity in the days after the update.
What this means for decision-makers
- Assign staff to install the patches immediately at the announced release time.
- Verify the patch status of your PHP web servers directly against the BSI advisory.
- Watch exposed PHP servers closely for unusual activity in the days after the update.
This story was produced automatically from the source named above and checked by software before publication. The image is symbolic and shows neither the event nor a real person. How this paper is made