Two serious flaws found in software behind most websites

Two serious security flaws were disclosed this week in PHP, a programming language used to build websites. The PHP Foundation, which maintains it, released a fix for newer versions. Within hours, many attempts to exploit the flaws were already showing up online. If your business website runs on PHP, this is a job for today.

What happened

PHP is free, open-source software. Experts estimate about 70% of websites worldwide use it. That includes many businesses, online stores and large corporations. Yonaton Keller, a product manager at security firm Zafran Security, says his team learned of the flaws early Wednesday. Some details leaked on an online forum before the official release. The post was deleted within minutes, but screenshots spread quickly.

Why it matters

Attackers need essentially no login or password to use these flaws. Keller says that makes them very different from past PHP problems. He also says AI tools mean even unskilled attackers can try to use them within minutes.

The risk goes beyond a defaced or broken website. Keller describes attackers taking control of a server, stealing sensitive documents and moving deeper into a company's network. From there, they could deploy ransomware, which locks up files until a payment is made.

Who can relax a little

Sites made only of very basic HTML pages are unlikely to use PHP. Keller advises assuming that most other sites use it somewhere. A web address that looks simple can still sit on top of PHP, so it is worth asking rather than guessing.

What to do

The alert box above lays out the steps. In short, find out where PHP is used, check what security scanners report, and upgrade. The upgrade is free, though Keller says some follow-up technical work may need a developer or your hosting company. Taking a site offline is an emergency move, only for signs of an attack.

What happens next

Keller says things have calmed a bit since Wednesday, but he remains very concerned. Updating millions of sites takes time, and attackers are getting faster. That leaves a window in which unpatched sites stay exposed.

The material does not say how many sites have been compromised so far. It also does not say what owners of older PHP versions that did not get the fix should do. Your web team or host should be able to answer that for your setup.