PHP released emergency patches for two related critical flaws as government agencies and other organizations worldwide took websites offline as a precaution. The flaws could let attackers run code on affected servers without logging in, but PHP’s security team said it had identified no functional exploits at public disclosure.
The PHP Foundation said signs of the underlying flaw first appeared in 2024. It called the delayed fix a “structural failure,” citing an indecisive security process and limited resources. The issue became a top priority after Calif and OpenAI independently reported it again on August 11, with Calif demonstrating remote code execution.
