The PHP Foundation said delays in fixing critical security flaws first identified in 2024 stemmed from hesitation in decision-making and a lack of resources, describing the lapse as a "structural failure." PHP, a programming language widely used across websites and web applications, has now issued emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
The issue prompted operational responses in several countries. Some government websites or online services in the Netherlands, Finland, France, Germany and Australia were temporarily taken offline to prepare for patch deployment. Security firm Calif and OpenAI each reported the same underlying issue on Aug. 11, with Calif also demonstrating unconditional remote code execution.
In the crypto sector, blockchain security firm SlowMist reviewed PHP exposure and found direct PHP fingerprints on 793 of 1,488 domains it assessed. Intersect temporarily shut its Members Area, while Coinbase said it found no affected PHP instances and digital asset infrastructure company BitGo said its platform was not impacted. Binance co-founder Changpeng Zhao urged users to stay cautious when visiting websites, and OpenAI released a Codex skill to help check vulnerable PHP versions.
The PHP Foundation said delays in fixing critical security flaws first identified in 2024 were caused by hesitation in decision-making and limited resources, calling the delay a "structural failure."
Emergency patches released for two related critical vulnerabilities
PHP, a programming language widely used for websites and web applications, has released emergency patches for two related critical vulnerabilities. The flaws could let unauthenticated attackers execute code on affected servers without logging in.
Some government services were temporarily taken offline
Some government websites or online services in the Netherlands, Finland, France, Germany and Australia were temporarily taken offline as preparations were made to install the patches.
Calif and OpenAI reported the same underlying issue on Aug. 11
Security firm Calif and OpenAI separately reported the same underlying issue on Aug. 11. Calif also demonstrated unconditional remote code execution.
Crypto firms reviewed their PHP exposure
Blockchain security firm SlowMist investigated PHP usage across the crypto industry and found direct PHP fingerprints on 793 of the 1,488 domains it evaluated.
Intersect has temporarily shut down its Members Area. Coinbase said it did not find any affected PHP instances, while digital asset infrastructure company BitGo said its platform was not affected.
Binance co-founder Changpeng Zhao urged users to stay cautious when visiting websites in the near term. OpenAI has released a Codex skill for checking vulnerable PHP versions.
The report was cited by Cointelegraph.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
