Critical PHP Vulnerabilities Allow Remote Code Execution on 70% of Websites

A recent study has revealed critical vulnerabilities in PHP, a widely used programming language that powers around 70% of all websites globally, according to wiz.io.

These vulnerabilities enable remote code execution and memory disclosure, posing a significant threat to website security. The flaws, which have been present for over a decade, affect every PHP version released in the last ten years, dating back to version 5.4.

The vulnerabilities allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially exposing passwords, authentication tokens, and API keys. The issues are particularly concerning as they can be exploited remotely, and in some cases, fairly easily.

Immediate patching is strongly advised, as the vulnerabilities can have a significant impact on website security. The PHP team has released a patch fixing multiple memory-safety vulnerabilities in the core engine.

This discovery highlights the importance of regularly updating and patching software to prevent exploitation. The study also demonstrates the power of AI in uncovering long-standing vulnerabilities that had remained hidden for years.

PHP is a backbone of the web, powering popular platforms such as WordPress, Joomla, and Drupal. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure.

The vulnerabilities have been grouped under two CVEs, with a severity rating of CVSS 9.2. The PHP team, along with other industry partners, worked to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure.