PHP Patches Released After Precautionary Website Shutdowns

PHP developers released security updates Wednesday for two critical vulnerabilities that prompted government agencies and other website operators to take public-facing services offline as a precaution. The flaws were rated 9.2 out of 10 and could allow an attacker to execute code on a server without authentication under certain conditions. The patches address vulnerabilities in PHP, a widely used programming language that supports websites and web applications. The PHP security team identified the fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The National Security Agency advised organisations to apply updates promptly or take vulnerable systems offline, warning that the flaws could provide access to a server’s file system or database. In Finland, the government ICT Centre, Valtori, restricted incoming public internet traffic to protect government systems. Valtori said it had found no evidence of exploitation and described the measure as preventive, not a response to a confirmed breach. Internal government network traffic remained unaffected. The centre said it would restore public access after applying patches and completing security checks. Other interruptions were...