Critical PHP flaw exposes 70% of all websites to takeover risks
In brief
- A critical PHP flaw, used by 70% of websites, enables remote takeover attacks.
- Emergency patches were released on October 21, but deployment will take time.
- Governments and companies have already taken sites offline pending security updates.
A critical security flaw in PHP, the language powering over 70% of all websites, has been disclosed. According to the announcement, the vulnerability could allow hackers to take control of millions of sites and their servers if left unpatched. Several European governments and operators like the Port of Rotterdam have already taken their websites offline while waiting for a fix.
Cybersecurity agencies from Australia, the US, the UK, Europe, and Japan have urged developers to urgently apply patches released by PHP’s maintainers. However, updating millions of systems using this language will take time due to its complexity and multiple dependencies.
The flaw was discovered in August by researchers at Wiz, who used internal tools and AI models from Google and OpenAI to analyze PHP’s codebase. Their premature disclosure on Hacker News led to an emergency patch release on October 21, but deploying it remains a major challenge for web security.
What it changes for you
- CybersecurityCybersecurity teams must prioritize deploying PHP patches and assess risks for their infrastructures.
This summary gives you the essentials. The full article, its figures and quotes are on The Conversation : IA.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error