PHP Releases Urgent Fixes as Websites Go Offline

PHP developers released emergency fixes for two critical vulnerabilities on Wednesday, urging users to install the updates immediately as organizations took some websites offline while addressing the risk. The flaws could allow attackers to run unauthorized code on affected servers without logging in, according to cybersecurity advisories. The vulnerabilities received severity ratings of 9.2 out of 10 on the CVSS v4.0 scale. PHP developers issued updates addressing both flaws and advised operators who could not patch affected systems to consider taking them offline. Government agencies and other organizations in several countries temporarily suspended websites or services as a precaution, though reports did not establish a complete count of affected sites. The U.S. Cybersecurity and Infrastructure Security Agency said it had not observed exploitation when it published its advisory. Cloudflare Chief Technology Officer Dane Knecht, by contrast, said the company was seeing early attacks and updating firewall mitigations as a temporary measure. These statements describe different observations and do not establish how many systems, if any, were successfully compromised. The...