Find articles

Two critical security vulnerabilities in PHP, a programming language used by millions of websites, have prompted urgent warnings to governments, businesses and other organizations worldwide, with some services taken offline.

A critical security flaw in the programming language underpinning much of the web has prompted a global rush to patch vulnerable systems.

We’d like to hear from small businesses that have been affected by the PHP code flaw. Did you have to take you website offline? Did you manage to patch the fault? Websites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code , cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers to take control of web servers, steal data and disrupt services. The problem in the PHP programming language, which underpins about 70% of the world’s websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault. Continue reading...

Governments and businesses in Kenya, the Netherlands and elsewhere were scrambling to prevent hackers from exploiting a vulnerability in PHP, a widely used programming language.

Problem in PHP language that underpins 70% of websites has led governments and companies to pull sites offline while they patch fault Websites around the world have been hit by millions of attempts to exploit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US National Security Agency warned the flaw could allow attackers to take control of web servers, steal data and disrupt services. The problem in the PHP programming language, which underpins about 70% of the world’s websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault. Continue reading...

I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions. It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing. As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates. That clearly backfired in a pretty wild fashion. I have learned my lesson. Comments URL: https://news.ycombinator.com/item?id=50193416 Points: 390 # Comments: 161

Much of the internet could be vulnerable to hackers, according to the creators of the technology that powers a massive chunk of cyberspace. The creators of PHP, which powers as much as 70% of the world’s websites, said Wednesday that its system is facing a critical security problem that hackers could use to take control […]