PHP Foundation admits ‘structural failure’ delayed critical security fix
Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.
Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.
The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”
Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among government sites affected by the PHP issue.