PHP Foundation admits ‘structural failure’ delayed critical security fix
Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.
The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”
Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
PHP is a programming language widely used to power websites and web applications, including content management systems.