Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw.
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in PHP sent website operators around the world scrambling to protect their systems.
PHP underpins large parts of the internet and the vulnerabilities had raised concerns that a significant number of websites could be vulnerable to attack. The developers issued four patches to address two “critical” vulnerabilities that could allow hackers to execute code on vulnerable systems.
It said users were strongly encouraged to update immediately.
The PHP Foundation, which oversees development and maintenance of the software, said in a blog post that a security researcher in 2024 found the first signs of a flaw that led to one of the vulnerabilities, but that the issue was “theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.”
The delay in addressing the flaw “was a structural failure,” the foundation said.
The programming language’s developers had earlier said they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released. Security experts warned that hackers would quickly reverse engineer the patches and race to exploit unpatched systems.
The US National Security Agency said in a statement that the vulnerabilities “often provide a direct path to the server’s file system or database,” and that if an immediate update was not feasible, organizations should take systems offline for full mitigation.
The Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory that organizations “should immediately update” their PHP installations. “While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the agency said in an advisory.