PHP Foundation admits ‘structural failure’ delayed critical security fix

Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.

The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.” 

Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in. 

PHP is a programming language widely used to power websites and web applications, including content management systems. 

Read more