PHP Foundation Acknowledges Structural Flaw in Vulnerability Fix

The PHP Foundation acknowledged a 'structural failure': the fix for a critical vulnerability first noticed in 2024 was delayed due to indecision and lack of resources. Two related critical vulnerabilities allowed unauthenticated attackers to execute code on affected servers – emergency patches were released on Wednesday.

'We won't pretend otherwise: the delay was a structural failure caused by both the decision-making process of the security team and a lack of resources,' the foundation's blog states. Developers couldn't quickly propose a solution without disrupting the vast PHP software ecosystem; the small team with deep engine knowledge was short-handed, and there was no known path to remote code execution.

The foundation was alerted to the vulnerability again on August 11: Calif and OpenAI independently reported the same issue, with Calif demonstrating unconditional remote code execution. This made the issue a priority.

On Wednesday, government websites and services worldwide went offline during patch installations. The Netherlands disabled its digital identification service and the national cybersecurity center's site, Finland's Valtori took public government web services offline, France's Ministry of the Interior disabled prefecture sites, and Germany's ITZBund took several sites offline, according to Reuters. The Australian Signals Directorate (ASD) confirmed its cyber gov au site was affected. Japan's Prime Minister Sanae Takaichi urged operators to install the patch as soon as possible and noted that temporarily disabling functions reduces risk.

The Wikimedia Foundation temporarily disabled Toolforge and Cloud VPS – hosting for volunteer tools and projects, causing partial unavailability of Wikipedia on Wednesday. The Cardano organization Intersect disabled the Members Area while assessing risks.

Blockchain security company SlowMist examined 1,488 domains and found 793 with direct traces of PHP; it urged exchanges, DeFi platforms, and wallet providers to check their exposure and update.

Coinbase's Chief Security Officer Jeff Lunglhofer stated that no vulnerable PHP instances were found in the company and added that upon such reports, the company conducts a full examination and works with third-party vendors. BitGo also reported that the platform was not affected. Binance co-founder Changpeng Zhao urged 'extra caution' when visiting sites in the coming days. OpenAI released a tool on GitHub, Codex, to help operators check for vulnerable PHP versions.

The PHP security team reported that no functional exploits were identified at the time of public disclosure.