A security release due at 14:00 UTC fixes two 9.2-rated PHP vulnerabilities, and agencies say unpatched sites may need to go offline.
PHP's developers have warned that a security release scheduled for Wednesday, October 21 at 14:00 UTC (10 AM ET) will fix two critical vulnerabilities, each rated 9.2 out of 10. The language runs a very large share of the web, so administrators are being told to be ready to update the moment the patch appears.
The PHP project's own site confirms the schedule. It says the team reserves the right to release earlier if details of either flaw become public or if exploitation is seen in the wild. Full details, affected versions and fixed versions will be published with the release.
What is known so far
According to The Verge, security firm watchTowr describes the issues as remote code execution flaws that reportedly affect every PHP version from PHP 5 onward. That kind of bug could let an attacker run their own code on a server, change a website, or steal data. One researcher cited by the outlet estimates that more than 1.3 million internet-connected hosts are likely affected.
WordPress security provider Wordfence warned that every WordPress site is exposed because they all run on PHP. It also said the fix cannot be installed through automatic updates, so owners need to find out who manages their PHP version and update it manually.
Advice from agencies and researchers
The EU's computer emergency response team and the UK's National Cyber Security Centre have both issued advisories. They say that organizations unable to patch straight away should isolate internet-facing applications from public networks, or take them offline, until the flaws are fixed.
PHP developer Gina Peter Banyard said patching is the only mitigation and that turning servers off "might be the most sensible thing to do" otherwise. The Verge reports that GrapheneOS has already taken its user forum offline because proof-of-concept exploits are being developed.
Attacks may start quickly
Researchers at Sansec told The Verge they expect "mass attacks within 15 minutes of the release." Cloudflare's chief technology officer, Dane Knecht, said the company is already seeing early attacks emerging against PHP sites on its platform, and it is temporarily updating its firewall rules as a stopgap until the fix ships.
For site owners, the practical steps are to find out which PHP version is running, confirm who is responsible for updating it, and apply the fixed release as soon as it is published.
Picture credit: The PHP Group
