Seven in ten websites are waiting on a patch
Two critical flaws in PHP, the language behind most of the web, leaked before they could be fixed. Most families won't have to patch anything. The people they trust with their data will.
On Tuesday, a post appeared on Hacker News naming two security flaws in PHP that weren't meant to be public yet. It was deleted within hours, but screenshots spread. Within hours, watchTowr, a security research firm, said it had reproduced one of them, and PHP's own security team published an emergency notice: two critical vulnerabilities, a fix coming on Wednesday, and a request that everyone running PHP get ready to upgrade.
Researchers have nicknamed the pair php2shell. The name says what's feared: send the right request to a website, and you get a shell on the server behind it, which means control of the machine and everything on it. PHP released the fix early on Thursday, Sydney time, with an outline of both flaws: one in how PHP recovers when a request runs out of memory, the other in data one request leaves behind for the next. Neither needs a login. On the setup PHP rates most at risk, a single request can trigger the attack before the website's own code has even started.
- Severity
- Critical 9.2 out of 10, as rated by PHP
- Fix
- Out now: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released early Thursday 22 October, Sydney time
- Affected
- Every PHP 8.2 to 8.5 release before the fix, on every common web server setup. PHP rates Apache with mod_php most at risk
- Where
- PHP's core: how it recovers when a request runs out of memory, and data left over from one request that the next can use
- Old versions
- No official release for PHP 8.1 or older. PHP posted source-code fixes for 7.4, 8.0 and 8.1, for people who build PHP themselves. Nothing for older versions
- Attacks seen
- Disputed. watchTowr and Cloudflare report early attacks. Huntress and CISA hadn't seen any as of Wednesday, US time, and it isn't on CISA's list of known exploited flaws
Why this one is big
PHP is the language underneath WordPress, Drupal, Magento and a long tail of booking systems, client portals and school websites. W3Techs, which tracks the technology behind websites, puts it at about 70% of the sites whose server-side language it can detect.
PHP
WordPress
Drupal
Joomla
Laravel
The harder number is how many of those are old. More than a third of PHP websites still run version 7 or 5, which PHP stopped supporting years ago. PHP's official fix covers only 8.2 and newer. For 7.4 it posted source code a capable administrator can build from, and for anything older there's nothing to install. Some Linux vendors and paid support firms are backporting their own fixes, but most of those owners will have to upgrade, which is real work, or put the site behind protection and hope. The US cybersecurity agency, CISA, goes further: if a PHP system can't be patched, take it offline until it can.
You can patch your own phone. You can't patch the thirty servers your family's data lives on.
It isn't your server. It's everyone else's.
Almost no family runs PHP at home. But think about where your details actually sit: the school's parent portal, the real estate agent's website, the family office's WordPress site, the accountant's client login, the booking system at the clinic. Some of those run PHP, and some run it on versions nobody has touched in years.
None of them are yours to fix. Each is someone else's job, on someone else's timeline, and you'll usually only hear about it if something goes wrong. That's the gap we wrote about in our essay: the companies you've given access to are another way in.
What to do this week
- Ask whoever runs a website for you.The family office, a business, a foundation, a personal site. Ask in writing: do you use PHP, which version, and have you installed Thursday's fix?
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting companies and Linux vendors may number their fixed versions differently, so ask them to confirm. - If the answer is PHP 8.1 or older, ask for a plan. Upgrade, take it offline, or put it behind a firewall. "We'll look into it" isn't a plan.
- Expect emails that ride the news. "Urgent security update, log in to confirm" is the oldest trick there is. Don't click. Go to the site yourself.
- Watch for breach notices over the next few weeks. If a company tells you it was affected, change that password. If every password is different, one breach stays one breach.
Or have someone do it. Knowing which of your vendors run what, and calling them before the exploits land, is exactly what private cybersecurity is for.
Sources
The fixed versions, who is most at risk, and fixes for older versions.
php.net
No attacks seen yet. Take systems offline if they can't be patched.
cisa.govThe fixed versions, and Cloudflare's report of early attacks.
bleepingcomputer.com
No attacks on its partners' systems as of Wednesday, US time.
huntress.com
Reproduced one flaw before the fix. Now reports attacks from 21 October.
watchtowr.com
The leak, PHP's notice, the 9.2 rating and watchTowr's reproduction.
bleepingcomputer.comAbout 70% of websites with a known server-side language, and the split by version.
w3techs.comMore from the journal
- Rules off, $20 a month
A startup now rents out AI models with their safety rules removed. Signing up is free, there are no identity checks, and nothing you type is kept.
- Someone is collecting AI keys
Fireworks AI, OpenCode and now Railway. Three platforms in fifteen days, each breached for the same kind of thing: the keys their customers trusted them to hold.
- The guardrails came off in 35 hours
DeepSeek released a new open AI model on a Saturday afternoon. By the early hours of Monday, Sydney time, a version with its safety rules removed was online for anyone to download.