According to Decrypt, two critical bugs in PHP—the server-side scripting language used by a large portion of websites—were discovered and subsequently patched. These vulnerabilities allowed remote attackers to take over servers without requiring authentication or a password. The patch was released promptly after the flaws were identified.
Exploitation of the bugs began shortly after disclosure, indicating that malicious actors actively targeted affected systems before the fix became widely deployed. In response, some government agencies and infrastructure operators temporarily disabled or isolated PHP-dependent services to mitigate risk.
PHP powers a significant number of internet-facing applications and websites, which is why the vulnerabilities carried broad potential impact. While the patch addresses the flaws, affected deployments must apply it to regain security. No details regarding exact numbers of sites or regions were provided by the source.
