PHP to release emergency fixes tomorrow for two severe security flaws

The team behind PHP, a programming language that powers a huge number of websites, is warning administrators to get ready for emergency security updates tomorrow. The updates fix two serious flaws. Each is rated 9.2 on a 10-point scale, which counts as critical.

What changed

Security firm watchTowr says both flaws are remote code execution problems. In plain terms, that means an attacker could run their own commands on a server from far away. The PHP security team asked administrators to prepare before the fixes arrive. BleepingComputer reported the warning.

Who it affects

PHP runs behind the scenes on many web servers. That can include company websites, WordPress and other content systems, client portals and custom business applications. If your site or portal uses PHP, this touches you, even if you never see the code. Sites that do not use PHP are not part of this warning.

What we do not know yet

The material so far does not say which PHP versions are affected. It also does not explain how the flaws work or whether attackers are already using them. Those details should come with the update notes. Until then, treat the warning as real and plan for it.

What to do

The alert box above lists the steps. The main point is simple: find out who looks after your PHP, and make sure they are ready to install the update as soon as it is released.

What happens next

The updates are due tomorrow. Watch for notices from your web host or IT provider, since some hosts apply fixes for their customers.