‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Key points

• The PHP Foundation has released emergency security updates for two critical flaws in the PHP programming language, which could let attackers gain remote control of victim systems. The flaws affect PHP installations going back to version 5, but only PHP 8.2 and newer are still supported with patches.
• Security experts warn that attackers could begin exploiting unpatched systems quickly. Some organisations took their websites offline before the fixes arrived.
• The FBI has urged anyone who finds signs of compromise to isolate the system and report it.