Crypto security chiefs sound alarm as PHP emergency patch scrambles devs worldwide
Summary
PHP released patches for two critical, unauthenticated remote-code-execution flaws, dubbed PHP2Shell, affecting web-facing installations. Cloudflare has observed attack traffic, and security leaders urged operators to update, mitigate exposure if patching is delayed, and check for signs of prior compromise. The fixes cover supported PHP releases; operators on older branches should consult vendors or upgrade. The warnings also spotlight embedded PHP in network devices that may rely on vendor firmware updates. Separately, Node.js issued security updates for high-severity flaws, and eight compromised eMudhra certificates were blocked. No breach of Kraken or Ledger was reported.
