PHP fixes two critical flaws that let attackers take over servers

PHP has released security updates for two critical flaws. Either one could let an attacker take control of a web server over the internet without logging in. The project says every web-serving PHP deployment is affected and urges all PHP users to update.

What changed

PHP is a programming language that runs a large share of websites behind the scenes. The new releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Each one fixes both vulnerabilities.

The flaws are called unauthenticated remote code execution bugs. In plain terms, a stranger could send a request to a vulnerable server and make it run the stranger's commands. No password or account is needed. That is why they are rated critical.

Who it affects

Anyone whose website, customer portal or web app runs on PHP. That includes sites built on PHP tools such as WordPress. Most owners will not run the server themselves, so the real work falls on hosting companies and developers.

Readers who only visit websites, or who use a site built on something other than PHP, have little to worry about from this alert.

What to do

The alert box above lists the steps. The short version: find out which PHP version your site uses, then ask your host or developer to move to one of the fixed versions this week.

What is not known yet

The material does not say how the flaws work in detail, whether attackers are already using them, or which older PHP versions are left without a fix. Check with your host or developer for the latest guidance.