OpenAI · Calif · Cointelegraph
PHP Foundation admits ‘structural failure’ delayed critical security patch
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.
Key facts
- In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among government sites affected by the PHP issue
- The Netherlands shut its digital identity service, and the country’s National Cyber Security Center also took its website offline
- The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure
- Following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large
Summary
The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.” Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. PHP is a programming language widely used to power websites and web applications, including content management systems. Following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.