The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a "structural failure," according to Cointelegraph. Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities that could let unauthenticated attackers execute code on affected servers without logging in.
PHP is a programming language widely used to power websites, web applications and content management systems. In a blog post after the patch, the foundation said its developers first spotted signs of the vulnerability in 2024 but struggled to craft a fix without disrupting the large ecosystem built on PHP. "Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months," the foundation said. "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources." The flaw was flagged again Aug. 11 after security firm Calif and OpenAI independently reported the same underlying issue — Calif demonstrated unconditional remote code execution, making it a top security priority.
The disruption stretched worldwide: the Netherlands shut its digital identity service and its National Cyber Security Center took its website offline; Finland's state IT provider Valtori disconnected public web services; France's Interior Ministry temporarily took prefecture sites offline; Germany's federal IT provider ITZBund disabled several sites, according to Reuters; and Australia's Signals Directorate confirmed cyber.gov.au was affected. Japanese Prime Minister Sanae Takaichi urged operators on X to prepare the patch as quickly as possible, saying temporarily suspending website functions could reduce risk if it couldn't be applied immediately. The Wikimedia Foundation took Toolforge and Cloud VPS offline as a precaution, knocking parts of Wikipedia offline Wednesday.
In crypto, SlowMist's MistEye survey identified 793 domains with direct PHP fingerprints among 1,488 assessed, urging exchanges, DeFi platforms and wallet providers to review exposure and upgrade. Intersect, the Cardano governance organization, temporarily took its Members Area offline. Coinbase chief security officer Jeff Lunglhofer said the company found no evidence of exposed PHP instances: "Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We're also working with our third party suppliers for extra assurance." BitGo said its platform was unaffected.
Binance founder and former CEO Changpeng Zhao (CZ) warned internet users Wednesday to be "extra careful" visiting any website in the next few days, as some web administrators may not be up-to-date with security patches. OpenAI released a Codex skill on GitHub to help operators check for vulnerable PHP versions and identify applicable updates. The PHP security team said it has not identified any functional exploits at the time of its public disclosure.