The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”
Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
PHP is a programming language widely used to power websites and web applications, including content management systems.
In a blog post following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.
“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months,” said the foundation.
“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
The foundation was pointed to the vulnerability again on August 11, after security firm Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution, which made it a top security priority.
Websites go dark amid PHP security scare
The disruption stretched across the world as developers disconnected websites while preparing to install the emergency fixes.
The Netherlands shut its digital identity service, and the country’s National Cyber Security Center also took its website offline.
Finland’s state IT provider Valtori disconnected government public web services, while France’s Interior Ministry temporarily took prefecture websites offline. Germany’s federal IT provider ITZBund also disabled several websites, according to Reuters.
In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among government sites affected by the PHP issue.
Japanese Prime Minister Sanae Takaichi took to X to urge website operators to prepare to apply the patch as quickly as possible. In a post, she said temporarily suspending website functions could reduce the risk if the patch couldn’t be applied immediately.
The Wikimedia Foundation, which operates Wikipedia, said it took some supporting services offline as a precaution, including Toolforge and Cloud VPS, which host tools and projects used by volunteer developers, leading to parts of Wikipedia going offline on Wednesday.
Blockchain security firm SlowMist said its MistEye service surveyed PHP use across the crypto industry, urging exchanges, DeFi platforms and wallet providers to review their exposure and upgrade. It identified 793 domains with direct PHP fingerprints among 1,488 domains assessed.
Intersect, a membership organization supporting the Cardano blockchain’s development and governance, said it had temporarily taken its Members Area offline while it assessed potential exposure. The page is still offline at the time of writing.
Related: Tech giants rush to block 8 eMudhra certs that could enable fake sites
Coinbase chief security officer Jeff Lunglhofer said the company found no evidence of any exposed PHP instances.
“Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We’re also working with our third party suppliers for extra assurance.”
Digital asset infrastructure company BitGo also said its platform was unaffected by the PHP vulnerability.
Meanwhile, Binance co-founder Changpeng Zhao warned internet users on Wednesday to be “extra careful” visiting any website in the next few days, as some web administrators may not be up-to-date with security patches.
OpenAI has released a Codex skill to help website operators check for potentially vulnerable PHP versions and identify applicable updates, which can be accessed via GitHub.
The PHP security team said it has not identified any functional exploits at the time of its public disclosure.
