Two serious flaws in PHP, used by most websites, forced rushed fixes

Two serious security bugs were found in PHP last week, and some organizations pulled their websites offline until they could fix them. PHP is a free, open source programming language. It runs roughly 70% of websites, so a flaw in it can touch a huge number of sites at once.

What happened

Wiz, OpenAI, a research group called Calif and the PHP team worked together to fix the two bugs. Both were rated critical. Wiz is a security company owned by Google. Its CTO of Exposure Management and AppSec, Tomer Schwartz, took part in the scramble and discussed it on TechCrunch's Equity podcast.

The researchers say this is only the beginning. Their reasoning is that AI is changing how fast new weak spots in software can be found and used by attackers. Schwartz also argues that patching by hand will not scale, meaning people cannot keep up if every fix needs manual work.

Who should check

Anyone whose business website is built on PHP should ask whether the fixes are in. If you are not sure whether your site uses PHP, your web developer or hosting company can tell you. The steps in the alert box above cover what to ask for.

Sites that do not use PHP are not part of this story. The source does not say which versions of PHP were affected, what the bugs let an attacker do, or whether anyone used them against real sites. Those details are still unknown.