This PHP vulnerability has a severity rating of 9.2/10 and allows attackers to run code on servers. It affects PHP version 5 and later, potentially enabling website modification or data theft.
A patch is available, but it cannot be installed through automatic updates. Administrators must update PHP manually. If the issue cannot be fixed yet, systems exposed to the internet should be isolated from the network, or the website should be taken offline temporarily to stop the risk.
What This News Should Highlight
The image should depict many website servers alongside a security warning, making clear that this is a broad web infrastructure problem—not an issue affecting a single product. The vulnerability has a severity rating of 9.2 out of 10 and affects systems running PHP across the web.
When a Vulnerability Hits Close to Home
Website administrators must decide immediately whether to update PHP, isolate systems exposed to the internet from the network, or take the website offline temporarily, because this vulnerability allows attackers to run code on servers.
GrapheneOS chose to temporarily shut down its user forum after a proof of concept was developed, as it did not want to take the risk. Meanwhile, security agencies advise that if the issue cannot yet be fixed, isolating systems or shutting down servers may be the most appropriate option until the patch can be installed.
Where PHP Fits into the Web
PHP is a language used to build websites and web applications, so it powers many online services. A vulnerability at the PHP level therefore does not affect just one website; it reaches servers that use PHP as their foundation.
WordPress makes this especially clear, because every WordPress website runs on a server using PHP. WordPress states that its system powers more than 40 percent of the internet. This is why a PHP patch can affect websites on such a broad scale.
From Older PHP Versions to a Patch That Must Be Installed
PHP versions 5 and later have been identified as affected by a Remote Code Execution vulnerability. Attackers may be able to run code on servers, modify websites, or steal data.
| Factor | Before Installing the Patch | After Installing the Patch |
|---|---|---|
| Risk | A 9.2 out of 10 vulnerability that may be exploited | Fixes two critical vulnerabilities targeted by the patch |
| Need to Update | Should be upgraded immediately when the patch is available | Still requires verification and complete patch installation |
| Automatic Updates | The patch cannot be installed using automatic updates | Someone must be assigned responsibility and update PHP manually |
To be direct, this is not just a plugin update. The patch must be applied directly to PHP and the server.
What This Vulnerability Can Do to Systems
This is a Remote Code Execution vulnerability that may allow attackers to run their own code on PHP servers, affecting PHP 5 and later. The consequences include modifying website pages or stealing data from systems.
In practice, WordPress websites are also at risk because they run on servers using PHP. If the patch cannot yet be installed, security agencies recommend isolating internet-facing applications from public networks or temporarily shutting down websites until the issue is fixed, because taking servers offline may be the most appropriate option for now.
Install the Patch Immediately or Temporarily Shut Down the System
The first option is to install the PHP patch as quickly as possible. PHP developers state that this is the only solution, and it must be done manually because the patch cannot be installed through automatic updates.
If the patch cannot yet be installed, the EU Computer Emergency Response Team and the UK National Cyber Security Centre recommend isolating internet-connected applications from public networks or temporarily shutting down servers. PHP developers say that taking systems offline may be the most appropriate option.
| Factor | Install the PHP Patch | Isolate the Application from the Network | Take the Server Offline |
|---|---|---|---|
| Suitable Situation | Can be done immediately | The patch cannot yet be installed | The patch cannot yet be installed |
| Recommendations from Sources | PHP recommends upgrading as soon as possible | Recommended by security agencies | Recommended by security agencies and PHP developers |
| Effect on Service Availability | Service can resume | Reduces external access | Website service stops |
What This Patch Fixes and What You Still Need to Do Yourself
This patch fixes two critical Remote Code Execution vulnerabilities that may allow attackers to run code on servers, modify websites, or steal data.
Pros
- +Patches critical Remote Code Execution vulnerabilities
- +Reduces the risk of attackers running code on servers
Cons
- −Cannot be installed through automatic updates
- −Requires someone to update PHP manually at the server level
The Cost of Leaving the Vulnerability Unpatched
If PHP is not updated, websites may be attacked, causing system damage, data leaks, or unauthorized content changes. The impact is not limited to the server; it can also affect users and services that depend on the website.
If the patch cannot yet be installed, organizations may need to isolate internet-facing applications from public networks or shut down websites temporarily. The burden then falls on the team to assign responsibility, update PHP manually, and manage periods of service unavailability.
The PHP patch is available, and users should upgrade as soon as the release is ready. But reducing the risk starts with identifying who manages PHP on the server and then updating it in the right place.
Sansec warned that widespread attacks could appear within 15 minutes of the patch’s release, while Cloudflare has already reported early attacks. The gap between “patch released” and “update completed” is therefore not time that should simply be ignored.