// THE VERGE — CYBERSECURITY
A critical PHP vulnerability may take websites down today
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
A patch is about to roll out, but the exploit affects more than 40 percent of the internet.
A patch is about to roll out, but the exploit affects more than 40 percent of the internet.
Posts from this author will be added to your daily email digest and your homepage feed.
Posts from this author will be added to your daily email digest and your homepage feed.
Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they’re unable to apply the fix immediately.
The security patch is expected to drop today at 10AM ET — though the developers say they may release it earlier if the vulnerability details become public or there’s evidence of the exploits actively being used — and PHP users are being urged to “upgrade as soon as the release is available.” According to cybersecurity firm watchTowr, the vulnerabilities are Remote Code Execution exploits that reportedly impact every PHP version from PHP 5 onward, and could enable attackers to run their own code on affected servers, allowing them to maliciously alter websites, steal data, and more.
The impact of these vulnerabilities could be vast, with one security researcher estimating that more than 1.3 million internet-connected hosts are likely affected. WordPress security plugin provider Wordfence also warned that every WordPress site will be vulnerable because they all run on servers that use PHP, which is no small number given WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also warned that the fix can’t be installed using automatic updates, so site owners need to find out who is responsible for updating PHP to apply the patch manually.