The PHP development team announced two serious security vulnerabilities and urged users to update once fixes were available, BlockBeats reported on Oct. 21. The team said on Wednesday that new fixed versions had been formally released.
Government sites taken offline
After reports that hackers were exploiting the flaws, Dutch and Finnish government agencies preemptively shut portions of their websites before patches were available. Sites named in the report included the Port of Rotterdam, the Dutch government portal Overheid.nl, the Royal Dutch Football Association, websites for the Netherlands’ five major political parties and several hospitals.
Why the exposure is broad
The report said PHP supports widely used systems including WordPress, Drupal, Joomla and Magento. Citing W3Techs, it put PHP’s share at about 75% of sites where the server-side language can be identified, and said WordPress powers about 43% of all websites.
The flash did not provide CVE numbers, affected branches or patch versions. It described exploitation as reported rather than independently verified, so operators should consult the official PHP advisory for precise remediation.