PHP Foundation admits ‘structural failure’ delayed critical security fix
PHP released emergency patches for two critical vulnerabilities that could let unauthenticated attackers execute code on affected servers. The PHP Foundation said a flaw first identified in 2024 went unfixed for months because of indecision and limited developer resources, calling the delay a structural failure. Government agencies and other organizations worldwide temporarily took websites or services offline while assessing exposure and preparing updates. Crypto security firm SlowMist found 793 domains with direct PHP fingerprints among 1,488 surveyed and urged exchanges, DeFi platforms and wallet providers to check and patch systems. Cardano group Intersect took its members area offline; Coinbase and BitGo said they found no affected systems. PHP’s security team reported no functional exploits identified at disclosure.
