Security3 min
PHP fixes two critical flaws that let attackers take over web servers
PHP's maintainers released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical flaws that let an attacker run code on a server without logging in. The flaws are in PHP itself and were disclosed by Calif.io, Wiz, OpenAI and Quarkslab. OpenAI says it found them using its GPT-5.6 Sol model and expects similar findings to increase sharply. The PHP Foundation shipped the fixes a day early because the flaws' official ID numbers had started circulating online. It says it only fixed PHP 8.2 and newer, so older setups depend on third-party vendors, Wired reports. Cloudflare switched on protections about nine hours before the flaws were made public, and it saw attack traffic. Reuters reports that some government, school and hospital websites in Europe went offline, and The Verge says 4chan, DeviantArt and Wikipedia had problems.
Do anything? If you run a site on PHP, including WordPress, update PHP itself or ask your host to do it. Updating plugins alone does not fix these flaws. If you only visit websites, there is nothing to do.