Critical PHP Flaws Force Website Operators to Consider Going Offline
Fixes for two critical PHP flaws arrive at 14:00 UTC, and Sansec expects mass attacks within 15 minutes of release.
PHP’s maintainers will publish fixes today at 14:00 UTC for two vulnerabilities, each rated 9.2 out of 10, and the timing matters more than the score.
Ars Technica reported that security firm Sansec expects mass attacks to begin within 15 minutes of the release.
For many websites, the riskiest period starts when the patch appears, not before it. If you run anything on PHP, from a WordPress blog to a client’s Magento store, the hours before the release are your preparation time.
What is confirmed and what is still rumour
PHP’s notice, posted October 20, says both fixes ship together.
The team reserves the right to release earlier if details become public or exploitation appears.
The notice followed a leak of purported details. Security firm watchTowr says it has confirmed the vulnerabilities are real, and says the leak claimed they reach every PHP version since PHP 5 in 2004.
However, this range should be treated as unconfirmed until PHP publishes its own advisory.
The weaker part is the exploit. The leaked report reportedly included a video of a tool called PHP2Shell running code on web servers.
Ars could not locate the original report, so the demo is unverified.
Why updating your CMS may not be enough
The video reportedly shows code execution on WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS.
Each is a separate project with its own codebase. If the demo is genuine, a weakness shared by all of them would sit in PHP itself, not in any single app. That is an inference, not a finding from the researchers.
In practice, updating a plugin or CMS tool would not close a hole in the programming language runtime. The fix has to reach the PHP that your server actually runs.
According to Reuters, the EU Cyberguard (CERT-EU) said the 9.2 rating points to unauthenticated remote code execution, meaning an attacker can run code on a server without logging in, and advised organisations unable to patch to consider taking affected sites offline.
Another security researcher cited by Ars Technica estimated that about 1.3 million internet-connected hosts could be affected.
How to use the hours before the release
Ars Technica lists preparation steps drawn from security firms.
Identify who manages PHP in your organisation, catalog every app built on it, and set aside a dedicated maintenance window starting at 14:00 UTC.
Make sure you back up every site file and database before touching anything.
If you run non-critical sites, taking them offline until the patch is live is the safest move you can make.
Keep the official PHP homepage open in a tab and refresh it throughout the day, because maintainers will pull the trigger early if active attacks start popping up.
Source: PHP warns it plans to release 2 emergency patches imminently
