1.3 million websites threatened by severe PHP flaws
Two severe PHP vulnerabilities get patches in a little more than 12 hours as a purported exploit circulates.
PHP maintainers announced two vulnerabilities rated 9.2 out of 10. Patches will drop in a little more than 12 hours.
A purported exploit tool has leaked online, showing the flaws work on WordPress, Magento, Drupal, Joomla and others. The vulnerabilities affect every PHP version since 2004.
Mass attacks could start within 15 minutes of the patch release, researchers say. Website admins should prepare now.
Identify who manages PHP in your organisation and list all apps that use it. Plan a maintenance window, back up your files, and watch for early announcements.
Some experts suggest turning off non-essential systems until patches are applied.
- 9.2 out of 10
- Vulnerability severity rating
- 12 hours
- Time until patch release
- 15 minutes after patch release
- Expected attack window
- Every version since 2004
- Affected PHP versions
Why it mattersUnpatched sites face immediate risk of hackers gaining control. Delays put customer data and transactions in danger across the internet.
AustraliaAustralian businesses and government agencies running websites on PHP must patch urgently or face breaches affecting users, payments and operations.
✓ Claims checked against the source and corrected before publish. checked 4 h ago
Open this story in InSnip →
