If you run a website, check your server logs right now. A pair of brutal security flaws just dropped for PHP, and the entire web is scrambling.
The official PHP development team pushed out emergency updates to patch two critical vulnerabilities carrying a severe 9.2 out of 10 danger rating. These aren't minor bugs you can ignore until next month's maintenance window. Left unpatched, they allow unauthenticated remote code execution. Attackers can walk right into your server without credentials and take complete control.
PHP powers roughly 70% of all websites on the internet. WordPress alone handles more than 40% of those sites. When a core language driving that much infrastructure gets hit with a critical hole, nobody is safe by default.
CISA and the FBI Cyber Division didn't mince words. Both agencies issued urgent warnings telling organizations to patch immediately or pull vulnerable systems offline entirely. The UK's National Cyber Security Centre echoed the exact same command. If you can't update your production environment today, unplug it.
How the PHP Flaw Was Discovered
You might be wondering how these massive bugs came to light. OpenAI announced that their AI models actually helped researchers uncover the flaws. They led a coalition of maintainers and security providers over a two-month period to prep fixes ahead of public disclosure. Cybersecurity firm watchTowr had already flagged that attackers could exploit these gaps to run arbitrary code on live production boxes.
Using AI to find vulnerabilities at internet scale changes the game completely. It proves that automated reasoning systems can spot structural weaknesses faster than traditional auditing. But it also means malicious actors have access to the exact same capabilities. If defenders found it first, it's a massive relief. Next time, we might not be this lucky.
What You Need to Do Right Now
Temporary workarounds like tweaking server memory limits or upload configurations won't save you. They only buy a tiny bit of breathing room by reducing your immediate exposure profile.
- Verify your current PHP version. Log into your server terminal and run
php -vto see what you're running. - Apply the official patches. Head straight to the official PHP site and update your installations to the latest secure releases.
- Audit your hosting providers. If you rely on managed WordPress hosts or shared hosting, bug them to confirm their patching schedules are already complete.
- Isolate legacy apps. If you maintain an old internal app running ancient PHP versions that can't be upgraded easily, pull it off the public internet immediately.
Don't wait for a scanner to flag your IP address. Update your servers today.
