Yesterday, (October 21), it was reported by the National Cyber Security Centre that PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser. PHP is also used in a range of other products.
According to the NCSC in its statement, here, the security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
Following the discovery of the issue, cyber experts have been weighing in on why this is happening, what it means, and what we can all learn from it. Some have said that the vulnerabliliy or threat of attack, shouldn’t come as a surprise.
Donnan Mallon, threat intelligence analyst at Talion Cyber Security, commented: “PHP has now confirmed it discovered evidence of one of the vulnerabilities in 2024 but could not find a way for a threat actor to attack a system using it. This meant the vulnerability was overlooked until August 2026 when it was disclosed to them by Calif.”
In a video posted on LinkedIn, Javvad Malik, Lead CISO Advisor at KnowBe4 commented: “Imagine a bug hiding in PHP for decades, surviving every review, every audit, every “looks fine to me”, until an AI helped turn it into a working exploit.
“Two critical flaws: nearly 70% of websites needing updates, and attackers can take full control. Reuters say government sites in Europe have already gone offline. The fix is to update because what else would the fix be, which everyone does immediately after the meeting about the meeting.”
Given the disruption the issue is causing, Mallon notes how organisations will undoubtedly want to understand why more was not done two years ago.
He adds: “We are now seeing evidence from Amazon’s threat team that attackers were working to exploit the vulnerabilities days before the public leak, but what we now need to understand is if attacks actually go much further back than this.
“The possibility that attackers had advance knowledge puts organisations in a far more dangerous position than they have been led to believe.”
“Given this news, organisations must still focus on applying the patches, or taking sites offline, but they also need to monitor logs for evidence of historical compromise.
“This should now go back to 2024,” he continued, “which will add more pressure to security teams at a time when they are already completely overwhelmed.”
Ben Tiffin, Founder and CEO of The Outsourcing Agency, a website design & development and marketing company, is concerned that the worst of this problem is yet to come. He comments: “The patch is the easy part. Most of the sites we look after were on a current version of PHP and were covered as soon as the hosts rolled it out. The real problem is the long tail of older sites that nobody has touched in years.
“Of 318 sites we host, 12 were on versions that won’t get this fix at all. You can’t just flick a switch and upgrade them, either. Old plugins break on newer PHP, so every one needs checking first. We found three that would take the site down completely.
“A lot of small businesses had a website built five or six years ago and assume it just carries on. It does, until something like this happens. Software has a shelf life, and this week a lot of people found out what theirs was.
“The bit that worries me is the speed. These bugs were found by AI, and the exploits were built with AI too. Attackers can turn a disclosure into an attack faster than ever, so the gap between ‘patch released’ and ‘you’d better have installed it’ has more or less gone.”
For more cybersecurity news, click here
