'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes

The PHP security team has announced that two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale, are imminent. Preliminary information suggests that these flaws have been leaked prior to their official disclosure through a video featuring the tool PHP2Shell being used to remotely execute code on web servers. The PHP programming language is extensively used across the internet and powers numerous websites worldwide.

The fix is scheduled for release at 2pm UTC (10 am ET). Cybersecurity firm Sansec warns that the vulnerabilities affect all web servers running PHP 5.4 or later, and researchers anticipate mass attacks to commence within 15 minutes of the release. Dane Knecht, Cloudflare's chief technology officer, confirms that the company is already updating its firewall rules for PHP sites. Early attacks are already emerging, and Knecht advises users to update their mitigations as new vectors surface.

Knecht emphasizes that this is merely a temporary solution, urging prompt patching as soon as the update is released at 14:00 UTC. WatchTowr CEO Benjamin Harris confirms that two remote code execution vulnerabilities in PHP have been leaked, which were previously embargoed and set for release on Thursday at 11 am ET. These vulnerabilities affect PHP versions 5, 6, 7, and 8, and are classified as CVSS10, indicating their high severity.

While technical details cannot be shared due to sensitivity concerns, both vulnerabilities are confirmed to be genuine. Web administrators are advised to inventory all PHP installations, plan maintenance windows for the update, and back up site and database files. In the meantime, users are advised to remain vigilant and rely on the "server gods" for guidance.