Two critical flaws in PHP, the code behind much of the web, now have a fix. It will not install itself, so site owners must act.
A fix is out for two serious security flaws in PHP, the programming language behind a huge share of websites. It was released at 10AM ET on October 21. The catch is that it will not install by itself on most sites. Someone has to apply it by hand, and attackers are already moving.
PHP developers published a warning on Tuesday about two flaws rated 9.2 out of 10 for severity. Security firm watchTowr says they let an attacker run their own code on a website's server. That could mean changing a site, stealing data, and more. The firm says every PHP version from PHP 5 onward is affected.
The reach is wide. One security researcher estimates more than 1.3 million internet-connected hosts are likely affected. WordPress security company Wordfence warns that every WordPress site is exposed, because all of them run on PHP. WordPress reported last year that it powers more than 40 percent of the internet.
Online stores, customer portals and other web apps built on PHP are in the same position. A site that does not use PHP is outside this warning.
Attackers are not waiting. Security firm Sansec said it expected mass attacks within 15 minutes of the release. Cloudflare's chief technology officer, Dane Knecht, said early attacks were already hitting PHP sites on its platform. Cloudflare has changed its firewall rules as a temporary shield until the fix is in place.
GrapheneOS, a mobile operating system developer, took its user forum offline. It said test attacks were already being built and it did not want to take the risk. PHP developer Gina Peter Banyard said patching is the only real fix, and that turning servers off might be the most sensible move until then.
The alert box above lays out the steps. The main point is to find out today who looks after PHP on your site, whether that is your web host or a developer. Wordfence stresses that automatic updates will not apply this fix.
The European Union's computer emergency response team and the UK's National Cyber Security Centre both say companies that cannot patch right away should cut their apps off from the public internet or take them offline. Later Verge headlines say the flaws were exploited days before the patch, and that the Internet Archive was briefly forced offline. It is not yet clear how many sites have been hit, or how fast hosting companies will finish updating.
If your website runs PHP, make sure someone installs the new release by hand today, because automatic updates will not do it.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about you
