PHP language hit by major security flaws as global cybersecurity agencies issue urgent warnings

Software maintainers have issued emergency patches for two severe security flaws discovered in PHP, the widely used programming language that powers a large share of web applications and servers. Discovered on October 20, the vulnerabilities prompted an immediate global response from cybersecurity authorities, including the Indian Computer Emergency Response Team and the US National Security Agency, which advised operators to update systems immediately or take vulnerable sites offline.

What Happened

The two flaws, rated 9.2 out of 10 on the CVSS severity scale, allow remote attackers to execute malicious code on target servers under specific conditions. The first issue stems from a memory allocation failure during request processing that can trigger memory corruption when PHP attempts to clean up incomplete data. The second issue involves stale global state handling, where worker threads can inadvertently interact with memory left behind by earlier requests. Both weaknesses impact standard installations running through tools like Apache with mod_php, PHP-FPM, and LiteSpeed.

Response And Action

Researchers from OpenAI, Calif, and Wiz helped uncover the flaws, highlighting how artificial intelligence tools are accelerating vulnerability discovery. Frameworks and hosting providers have scrambled to respond, with Laravel Cloud automatically patching applications while Laravel Forge users must update manually. Administrators are urged to verify their server versions, apply the official security fixes right away, and monitor for any abnormal activity.

Context

PHP is a foundational open-source language used to build dynamic web pages and platforms like WordPress and Laravel. Because it operates directly on servers, a core engine flaw can expose thousands of distinct websites at the same time. Security experts emphasize that while artificial intelligence helps researchers find bugs faster, timely patching remains essential to prevent widespread cyber attacks.