PHP Foundation acknowledges 'systemic breakdown' caused two-year delay in crucial security patch
Internal organizational issues at the PHP Foundation resulted in a two-year postponement of a critical security patch, leading to precautionary website shutdowns globally on Wednesday.
The PHP Foundation has come forward to admit that insufficient resources combined with prolonged indecision resulted in the postponement of a fix for a severe security vulnerability initially discovered in 2024, characterizing the delayed action as a "structural failure."
Organizations and government entities across the globe implemented precautionary measures Wednesday by disconnecting their websites while PHP distributed urgent security patches addressing two interconnected critical security flaws. These vulnerabilities had the potential to enable attackers without authentication to run arbitrary code on vulnerable servers without requiring login credentials.
PHP represents a programming language with widespread adoption for powering websites and web-based applications, including various content management systems.
Through a blog post released alongside the patch, the foundation outlined the timeline of how its development team initially detected indications of the security flaw in 2024, but encountered significant challenges in developing a resolution that wouldn't cause disruption to the vast ecosystem of applications and software constructed using PHP.
Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.
We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources.
The vulnerability was brought back to the foundation's attention on August 11, following independent reports from security firm Calif and OpenAI identifying the same fundamental issue, with Calif providing a demonstration of unconditional remote code execution, elevating it to critical priority status for the security team.
Websites go dark amid PHP security scare
The impact rippled across the globe as system administrators and developers disconnected their websites while making preparations to deploy the emergency security updates.
The Netherlands implemented a shutdown of its digital identity service, and the nation's National Cyber Security Center additionally disconnected its website from the internet.
Finland's governmental IT service provider Valtori made the decision to disconnect public web services operated by the government, while France's Interior Ministry implemented temporary shutdowns of prefecture websites. Germany's federal IT service provider ITZBund similarly disabled multiple websites, according to Reuters.
In Australia, the Australian Signals Directorate confirmed that its cybersecurity website, cyber.gov.au, was included among the government websites impacted by the PHP security issue.
Japanese Prime Minister Sanae Takaichi utilized X to encourage website operators to make preparations for applying the security patch with maximum speed. In a post, she indicated that temporarily suspending website functions could minimize the risk if the patch couldn't be applied immediately.
The Wikimedia Foundation, which operates Wikipedia, stated it disconnected some supporting services as a preventative measure, including Toolforge and Cloud VPS, which host tools and projects used by volunteer developers, resulting in portions of Wikipedia going offline on Wednesday.
Intersect, a membership organization supporting the Cardano blockchain's development and governance, announced it had implemented a temporary shutdown of its Members Area while it assessed potential exposure. The page is still offline at the time of writing.
Coinbase chief security officer Jeff Lunglhofer stated the company found no evidence of any exposed PHP instances.
Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We're also working with our third party suppliers for extra assurance.
Digital asset infrastructure company BitGo also confirmed its platform was unaffected by the PHP vulnerability.
Meanwhile, Binance co-founder Changpeng Zhao warned internet users on Wednesday to be "extra careful" visiting any website in the next few days, as some web administrators may not be up-to-date with security patches.
OpenAI has released a Codex skill to help website operators check for potentially vulnerable PHP versions and identify applicable updates, which can be accessed via GitHub.
The PHP security team said it has not identified any functional exploits at the time of its public disclosure.