Security researchers warn of PHP vulnerabilities and urge immediate patching

Security researchers have identified long-standing weaknesses in the PHP programming language that could be exploited by automated tools. While no successful attacks have been reported yet, large web infrastructure providers such as Cloudflare and Palo Alto Networks say they have observed millions of probing attempts.

The PHP Foundation released a fix, but it applies only to the most recent version of the language, meaning sites running older releases must upgrade to apply the patch. Authorities are advising website operators to implement the update without delay.

"There's a real dilemma," said Professor Alan Woodward of Surrey University. "How do you alert people they need to be ready, and then that a patch is urgently required, whilst not alerting attackers? Basically you're telling everyone about the problem at the same time and hoping the defenders aren't awake enough to act as soon as the patch is out."

Professor Gina Neff, who studies responsible AI at Queen Mary University, described the collaborative effort that used AI to locate and remediate the bugs as a positive development, noting that the same technology could also be used by malicious actors.

Cybersecurity officials stress that the patch must be applied promptly, especially for sites that rely on older PHP versions, to prevent potential exploitation.