The PHP development team fixed the vulnerabilities by releasing patched versions after several government portals in Europe and elsewhere made the decision to pull their websites offline as site administrators attempted to safeguard public infrastructure against a pair of critical security flaws. PHP is an open-source, server-side scripting language primarily used for web development and the emergency measures followed a coordinated disclosure by the PHP development team, who released vital patches for two zero-day vulnerabilities capable of granting attackers unauthenticated remote code execution (RCE).
Security teams globally have been urged to update their PHP environments immediately. While the PHP project released emergency minimal source-backports for legacy versions back to PHP 7.4, officials emphasized that no complete mitigations exist short of applying the official updates.
The emergency response stems from flaws embedded within PHP’s core memory management architecture. Although signs of one underlying flaw were originally identified by a security researcher in 2024, the issue was initially treated as a theoretical concern and deprioritized in favor of more immediate threats. Because PHP powers nearly 70% of identifiable websites across the open web, the sudden publication of remote code execution paths forced cybersecurity authorities, including CERT-EU and CISA, to advise operators of mission-critical systems to temporarily isolate or take down affected websites until patches could be verified and applied.
