PHP Hit by Two Critical Vulnerabilities, Putting Websites at Risk of Downtime

PHP, the programming language powering a huge number of websites and web applications, has recently been found to contain two critical vulnerabilities. Developers have released a security advisory, and patches are expected to roll out soon. If these vulnerabilities are exploited, they could cause websites to crash or have broader internet-wide impact.

Vulnerability Overview: Two Critical-Severity Security Flaws

According to the advisory published by PHP developers, these two vulnerabilities carry a high severity rating. Although the original report did not disclose specific technical details, it explicitly states that they could cause serious damage to the internet. The vulnerabilities affect PHP itself, and since PHP is the foundation for numerous CMSs and frameworks such as WordPress, Drupal, and Laravel, the scope of impact could be very broad.

The advisory was released this Tuesday, and security patches are expected later the same day. This means system administrators need to act quickly, because once vulnerability details are made public, attackers may exploit them rapidly.

Remote Code Execution (RCE) is one of the most dangerous vulnerability types in web security. It refers to an attacker's ability to execute arbitrary code or commands on a target server through carefully crafted input, thereby bypassing all access controls and completely taking over the system. In the PHP context, RCE typically stems from deserialization flaws, improper use of eval-type functions, file inclusion vulnerabilities, or missing bounds checks in extension modules. Once exploited, an attacker can implant backdoors, steal database credentials, move laterally to other hosts on the internal network, or even add the compromised server to a botnet. Because PHP often runs under a web service account's privileges, the impact of RCE is often not limited to a single site but extends to the entire server and all applications it hosts.

Wormable vulnerabilities refer to security flaws that can spread automatically between systems without user interaction, as typically seen in Shellshock in 2014 and the vulnerabilities exploited by WannaCry in 2017. For PHP, if a vulnerability allows an attacker to trigger code execution through a single HTTP request and the target address can be discovered through scanning, the malicious payload can spread rapidly across the internet like a worm. PHP's massive installed base and the large number of outdated versions that are not updated in a timely manner make the potential propagation speed of such vulnerabilities extremely fast—which is the core reason the security community is highly alert to this advisory.

Potential Impact: From Website Crashes to Large-Scale Attacks

If the vulnerabilities are successfully exploited, the most direct consequence is website downtime. Attackers may trigger crashes through specially crafted requests, making services unavailable. More seriously, some vulnerabilities may allow remote code execution, thereby gaining full control of the server. Given PHP's enormous installed base on the internet, a wormable vulnerability could spread rapidly, similar to severe PHP security incidents in history.

There is currently no evidence that the vulnerabilities have been exploited in the wild, but the security community is highly vigilant. Website owners should closely monitor official PHP updates and prepare for emergency patching.

Recommendations: Immediate Updates and Mitigation Measures

For teams using PHP, the top priority is to watch for the release of official patches and upgrade to the fixed version as soon as possible. If immediate updates are not possible, temporary mitigation measures can be considered, such as blocking suspicious requests through WAF rules or reducing the attack surface. At the same time, it is recommended to review logs for signs of anomalous activity.

Security teams should prioritize PHP applications exposed to the public internet, especially those handling sensitive data or high traffic. Subscribing to the PHP security announcement mailing list or following official social media accounts can help obtain patch information as soon as it is available.

WAF (Web Application Firewall) is a security device or software deployed in front of web servers that intercepts known attack patterns by inspecting the characteristics of HTTP requests. During the window before PHP patches are fully deployed, a WAF can temporarily block exploitation requests targeting specific vulnerabilities through custom rules—for example, filtering abnormal parameter serialization content or suspicious request headers. But a WAF is not a silver bullet: it relies on timely updates to its rule set and may be bypassed through encoding or may falsely block legitimate traffic. Therefore, a WAF can only serve as an interim measure and cannot replace official patches.

CVSS (Common Vulnerability Scoring System) is the industry-standard framework for assessing vulnerability severity, with scores ranging from 0 to 10. It comprehensively considers attack vector, attack complexity, privileges required, user interaction, and impact on confidentiality/integrity/availability. Scores above 7.0 are generally considered high severity, and above 9.0 are critical. The article mentions paying attention to CVSS scores because they help security teams prioritize patching—the higher the score, the more urgently it should be addressed. At the same time, the range of affected versions determines which PHP versions need upgrading and is a key basis for formulating a patching plan.

Background and Outlook: Ongoing Challenges in the PHP Security Ecosystem

PHP has long been a mainstream language for web development, and its security directly affects internet infrastructure. Although the core team responds quickly, a large number of old versions are still running, giving attackers opportunities. This incident once again reminds developers of the importance of keeping dependencies updated and conducting regular security audits.

As patches are released, more technical details are expected to be disclosed. We will continue to monitor the vulnerabilities' CVSS scores, affected version ranges, and exploitation status to provide readers with follow-up analysis.

One-line Summary

PHP has been found to contain two critical vulnerabilities that can cause website downtime and even remote code execution; official patches are expected soon.

Paragraph Summary

PHP, the foundation for numerous CMSs and frameworks such as WordPress, Drupal, and Laravel, has recently been found to contain two critical-severity security vulnerabilities that could cause website downtime and even remote code execution. The official security advisory was released this Tuesday, and patches are expected later the same day. Because PHP has a massive installed base, the vulnerabilities could spread rapidly once exploited, similar to severe PHP security incidents in history. There is currently no evidence of in-the-wild exploitation, but the security community is highly vigilant. The article recommends that administrators immediately pay attention to official updates and upgrade as soon as possible; if immediate patching is not possible, they can temporarily use WAF rules to block suspicious requests, and should prioritize PHP applications exposed to the public internet, handling sensitive data, or serving high traffic.