PHP developers say key patches available after global scare
0 / 26
English
中文
Newly discovered vulnerabilities in the PHP programming language have put millions of websites at risk, with government agencies sounding alarms and taking down sites. Developers say updating systems is "imperative."
（暂无翻译） （暂无翻译）
The updates patching the recently leaked PHP security issues are now online, developers of the open-source programming language said on Wednesday afternoon.
（暂无翻译）
"All PHP users are strongly encouraged to update immediately," the team said in an online statement.
（暂无翻译）
Millions of websites worldwide, including critical infrastructure and government portals, as well as news sites and online shops, rely on PHP. The software is free.
（暂无翻译） （暂无翻译）
The new patches aim to fix two "critical vulnerabilities" hackers could exploit to remotely take control of websites and servers, bypassing usual obstacles such as password-protected accounts. The gaps were labeled CVE-2026-109618 and CVE-2026-109619.
（暂无翻译） （暂无翻译）
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video By exploiting them, malicious actors could gain access to government databases and customer data, deface websites, or compromise entire businesses or other online services.
（暂无翻译）
"If you run PHP, it is imperative that you update now," the PHP Foundation said in a blog post.
（暂无翻译）
The weaknesses were flagged by two separate security companies, Calif and Wiz, this August.
（暂无翻译）
Both of the firms used AI tools to detect the PHP issues. PHP developers kept the flaws confidential while working on the fix.
（暂无翻译） （暂无翻译）
News of the security issues, however, leaked on Tuesday, a day before the scheduled update. Hours before the PHP update, Dane Knecht, the chief technology officer of security firm Cloudflare, said hackers were already trying to exploit these weaknesses.
（暂无翻译） （暂无翻译）
"We are seeing early attacks emerging and are updating mitigations as new vectors show up," he said in an online post.
（暂无翻译）
The Wikimedia Foundation, which runs Wikipedia, said it was addressing the security vulnerabilities.
（暂无翻译）
"We have taken down a number of other systems as a precautionary measure until they can be safely patched," it said.
（暂无翻译）
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video Authorities in multiple countries, including Australia, Japan, and several European nations, issued warnings and took down government websites in an effort to preempt potential attacks.
（暂无翻译）
In France, the website of the Paris Police Prefecture was taken offline due to "detection of a critical security vulnerability," along with local government pages.
（暂无翻译）
Germany's government IT service took down some sites that used PHP.
（暂无翻译）
Belgium's Foreign Ministry temporarily blocked its own online presence, while the Dutch cybersecurity agency took itself online as a precaution. The US National Security Agency (NSA) warned that vulnerabilities "often provide a direct path to the server's file system or database." "If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated," they said on X.
（暂无翻译） （暂无翻译） （暂无翻译）
Meanwhile, the White House said it was informed of the issue last week and that US federal agencies were assessing the potential impact to government systems and infrastructure.
（暂无翻译）
If you rely on our team for trusted reporting, please take a moment to select us as your Preferred Source on Google, so you'll always see our verified news first.
（暂无翻译）
仅供学习使用，如有侵权请联系删除 · 查看原文