The patches are scheduled for release today at 10AM ET, though developers may accelerate the timeline if active exploitation intensifies. Security firm watchTowr warns that attackers could use these exploits to hijack servers, steal sensitive data, and deface websites. Because the fix requires manual installation, automated WordPress security plugins cannot mitigate the threat, leaving site administrators responsible for immediate intervention.
Critical PHP Vulnerability Threatens Millions of Servers
With a severity rating of 9.2 out of 10, two critical remote code execution vulnerabilities in PHP are forcing security agencies to advise site owners to take systems offline. The flaws impact every version from PHP 5 onward, potentially exposing over 1.3 million internet-connected hosts to malicious code injection.
Global authorities, including the European Union Computer Emergency Response Team and the UK National Cyber Security Centre, have recommended isolating internet-facing applications from public networks if patching is not immediate. GrapheneOS has already shuttered its forums to preempt potential breaches. Threat researchers at Sansec anticipate mass attacks within 15 minutes of the public patch disclosure. Cloudflare CTO Dane Knecht confirmed that early probing attempts are already underway, prompting the company to deploy temporary firewall rules as a defensive buffer until the official release.
Comments (0)
No comments yet. Be the first!