PHP Team Admits Slow Response Left Serious Security Hole Open

Two related critical bugs in PHP sent governments and companies scrambling on Wednesday, with many pulling sites offline until emergency updates could be installed. Attackers could run commands on a vulnerable server without any login. The Netherlands closed its digital identity service, Finland, France and Germany shut down public portals, and Australia’s cyber.gov.au was affected. Japan’s Prime Minister Sanae Takaichi urged operators to patch quickly or pause site features. Wikimedia switched off Toolforge and Cloud VPS, which took parts of Wikipedia down.

Why the PHP Security Fix Was Delayed

The PHP Foundation said it noticed warning signs in 2024 but could not find a safe fix for the huge amount of software built on PHP. Few engineers understand the engine deeply, and no remote attack route was known, so work kept stalling. It called this a structural failure. On August 11, Calif and OpenAI each reported the issue, and Calif proved remote code execution.

PHP Risk for Crypto Platforms

SlowMist found direct PHP traces on 793 of 1,488 crypto domains it checked. Intersect, which supports Cardano, kept its Members Area offline. Coinbase security chief Jeff Lunglhofer and BitGo reported no exposure. Changpeng Zhao urged caution online this week. No working exploits have been found, and OpenAI released a Codex skill on GitHub for checking PHP versions.