A significant security vulnerability impacting PHP, a server-side scripting language used by a vast portion of the internet, has put numerous websites and services at risk. The flaw, which was reportedly leaked by an unknown entity, allows for remote code execution without authentication. The potential consequences range from data erasure to the use of compromised websites for further attacks or ransomware operations.
While a fix is anticipated, the vulnerability is expected to remain exploitable for at least a full day. The PHP Foundation is actively working on a patch, scheduled for release on Wednesday, October 21st, at 2 p.m. UTC. Websites that rely on PHP have been advised to prepare for this update.
Even before the patch is available, the impact is already being felt. Prominent online communities and platforms such as 4chan, Something Awful, DeviantArt, and Fur Affinity have either temporarily gone offline or are operating in a read-only state. Larger organizations, including regional healthcare providers and national public services, are also taking precautions. Cloudflare is reportedly implementing emergency protections, and hosting providers like Amazon Web Services have already alerted their clients to the issue. Evidence suggests that malicious actors are already attempting to exploit the vulnerability using botnets to scan for potential targets.
PHP is a foundational technology that enables servers to retrieve and assemble the necessary information to build and serve web pages. It allows dynamic content to be delivered based on user input, handling the site's logic and delivery. Its widespread adoption means that approximately a quarter of all websites, including major platforms like WordPress, are potentially affected by this security breach.