In this article6 sections
The PHP Foundation said indecision and a thin bench of deep-knowledge developers kept it from patching a critical flaw first flagged in 2024, calling the delay a “structural failure,” according to Cointelegraph.
The bug matters because PHP underlies a large share of the web, including many content management systems. The foundation said unauthenticated attackers could run code on affected servers without logging in, and emergency patches for two related critical vulnerabilities went out Wednesday.
Also read: Spain’s CNMV Chair Rules Out MiCA Deadline Extension for Crypto Firms, Impacting Binance
Key facts
- The foundation traced the first signs of the flaw to 2024 but said work on a fix repeatedly stalled and restarted over months.
- Calif and OpenAI reported the same underlying issue independently on August 11, with Calif demonstrating unconditional remote code execution; that raised the flaw to a top security priority.
- Government sites went dark as a precaution, including the Netherlands’ digital identity service and its National Cyber Security Center site, Finland’s Valtori public web services, France’s prefecture sites and several ITZBund sites in Germany.
- SlowMist said its MistEye service found 793 domains with direct PHP fingerprints among 1,488 domains assessed across the crypto industry.
- In a Wednesday post, Binance co-founder Changpeng Zhao told users to be “extra careful” visiting any website over the next few days.
How the stall happened
In a blog post after the patch shipped, the foundation described a decision process pinned between two pressures: a sprawling ecosystem of software built on PHP that any fix could disrupt, and no confirmed path to remote code execution at the time. Core developers with the engine expertise needed to write a safe patch were spread across other duties, so the effort lost momentum and resumed more than once.
The foundation was blunt in its own assessment, saying it would not pretend otherwise and pointing to both the security team’s decision-making and its lack of resources. Once Calif and OpenAI surfaced the issue again in August, the picture changed and remote code execution became the priority, culminating in this week’s patch release.
Also read: Fake crypto startup lures suspected North Korean IT workers into a five-week intelligence trap
Sites pulled offline worldwide
Organizations took websites down pre-emptively rather than wait. In the Netherlands, both the digital identity service and the national cyber security center site were closed. Finland’s state IT provider Valtori disconnected public government web services, France’s Interior Ministry pulled prefecture websites, and Germany’s federal IT provider ITZBund disabled several sites, Reuters reported.
Australia’s Signals Directorate confirmed cyber.gov.au was among affected government sites. Japanese Prime Minister Sanae Takaichi urged operators on X to apply the patch quickly, adding that suspending a site temporarily can cut risk when patching is not immediately possible.
The Wikimedia Foundation said it took supporting services offline as a precaution, including Toolforge and Cloud VPS, which host tools and projects for volunteer developers, leaving parts of Wikipedia unavailable on Wednesday.
Crypto firms check their exposure
Blockchain security firm SlowMist urged exchanges, DeFi platforms and wallet providers to review their exposure and upgrade. Intersect, which supports the Cardano blockchain’s development and governance, said it took its Members Area offline while assessing exposure and that the page remained down at the time of writing.
Coinbase chief security officer Jeff Lunglhofer said the exchange found no evidence of exposed PHP instances, noting that it runs a full sweep whenever it hears of a vulnerability and is also working with third-party suppliers for extra assurance. BitGo said its platform was unaffected.
OpenAI released a Codex skill, available on GitHub, to help operators check whether they run vulnerable PHP versions and find the relevant updates. The PHP security team said it had not identified any functional exploits at the point of public disclosure.
Why it matters
A language embedded in so much of the web turns a single core flaw into a shared problem for governments, publishers and crypto platforms at once. The foundation’s own account shows that the slow part was not awareness but coordination: deciding how to fix an engine-level problem without breaking code that countless sites depend on. For operators, the practical lesson is to treat patch readiness as part of security planning, keeping a tested rollback and a way to take services offline quickly when a zero-day is disclosed.
What to watch
Follow whether the foundation publishes changes to its security-team structure or resourcing after its self-assessment, and watch operator reports for signs that the patched versions are broadly deployed. Any later finding of exploitation in the wild would shift the story from prevention to incident response.
Reported by cointelegraph.com.
Source: Cointelegraph