The PHP Foundation said fixes for critical vulnerabilities first found in 2024 had repeatedly stalled because of indecision and limited resources, calling the delay a “structural failure,” BlockBeats reported on Oct. 22.
Emergency patches
PHP released emergency patches for two related critical vulnerabilities. The flash said unauthenticated attackers could exploit the flaws to execute code on affected servers without logging in. It also reported that some government websites and online services in the Netherlands, Finland, France, Germany and Australia temporarily went offline while preparing to install the patches.
Those impact and outage descriptions are attributed to the BlockBeats report; it did not link a PHP advisory or provide vulnerability identifiers. Operators should consult PHP’s official security notices and apply the fixes appropriate to their supported branch.