PHP developers released emergency patches for two critical vulnerabilities, but websites must upgrade independently to use them. The PHP Foundation acknowledged that it had delayed fixing a critical flaw first identified in 2024 because of limited resources.
Immunefi CEO Mitchell Amador said smaller websites could take weeks to upgrade, leaving users exposed in the meantime. Cloudflare CEO Matthew Prince said its network saw millions of exploit attempts in the 24 hours after the vulnerabilities were disclosed. The FBI’s Cyber Division warned that the flaws may let attackers remotely run code and potentially compromise data and networks.
