Security3 min
PHP fixes two critical flaws that let attackers take over web servers
PHP's maintainers released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical flaws, nicknamed php2shell, that let an attacker run code on a server without logging in. The flaws are in PHP itself, in how it cleans up memory after an error. They were disclosed by Calif.io, Wiz, OpenAI and Quarkslab. OpenAI says it found them using its GPT-5.6 Sol model. The PHP Foundation shipped the fixes a day early because details had started circulating online. Only PHP 8.2 and newer got fixes, so older setups depend on third-party vendors, Wired reports. Cloudflare switched on protections about nine hours before the flaws were made public, and it saw attack traffic. Reuters reports that some government, school and hospital websites in Europe went offline, and The Verge says 4chan, DeviantArt and Wikipedia had problems.
Do anything? If you run a PHP site, including WordPress, update PHP itself now or ask your host to. Updating plugins or site code does not fix this.