In the morning, my Twitter feed was suddenly flooded with news about PHP.
The PHP Foundation writes about fixing two critical vulnerabilities in the core, both rated 9.2 out of 10 on the CVSS 4 scale, which is very high. Both vulnerabilities allow arbitrary code execution on the server—one due to an overflow error, and the other because the core can point to a memory area it shouldn't. A release with fixes will be published today at 14:00 UTC, and the PHP team strongly urges everyone to update immediately afterward.
To grasp the scale of the problem, you need to understand that a huge part of the internet's backend currently runs on PHP. A large percentage is on older versions, and a vast number of services won't update today, meaning potentially another swarm of agents will execute arbitrary code there and, at best, delete the database or leak data. At worst, they could steal money or disable some equipment that connects to this backend.
Reuters reports that the Dutch cybersecurity agency has taken its services offline as a precaution, followed by several sites in the Netherlands, including some hospital websites. The Danish municipal company Kombit is also taking its services offline, and in Finland, the disruptions are even more extensive—they have taken government websites offline until the fix is released.
To give you an idea, PHP currently powers, for example, Wikipedia, Etsy, Fandom, and millions of sites on WordPress and other platforms. Personally, about 5-7 years ago, I wrote Symfony applications with millions of users and billing.
It's amusing, of course, that both vulnerabilities were found using agents, and most likely, they will also be exploited using agents, which we will hear about very soon.
If your company has projects on PHP, and spoiler alert—in a huge number of CIS big tech and particularly fintech, especially the old ones, there are old monoliths on PHP—inform your security team that they need to update.