A fix
Available
PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, since 21 Oct
Severity
Critical
9.2 out of 10, both flaws
Confirmed break-ins
None
no named organisation, as of the latest capture
Taken offline
10 organisations
as a precaution, across 6 countries
Agencies compared
16
all say update; they split on offline
Three questions to put to your team this week
from your briefing1
Are we exposed?
Ask for the list, not a percentage: every system that runs PHP, including vendor products and hosting panels, and which are on the internet.
2
Is everything updated and restarted?
Updating is not enough until PHP is restarted. Ask for the running version, checked after the restart, system by system.
3
Who can pull a system offline, and how fast?
Every agency puts offline last, but you need to be able to do it in minutes. Name the person and rehearse it once.
Since you last looked
3 new- New 22 Oct, 06:55 UTCThe BBC reports the US NSA's advice: take systems offline if they cannot be updated.
- New 22 Oct, 07:00 UTCOne of the researchers who found the flaws tells BBC Radio 4 there is no evidence yet of them being used in attacks.
- New 22 Oct, 08:40 UTCThe Dutch national cyber agency's list of affected software reaches 674 products.
Read items disappear from this list. Everything new →
How it unfolded
The full timeline2024
An audit spots the out-of-memory weakness. Nobody can show it is exploitable, so it is left.
Aug 2026
Three teams using AI turn it into working attacks within three weeks and report them to PHP.
20 Oct
The secret leaks: the CVE numbers circulate two days early, with a wrong severity score.
21 Oct
PHP releases the fix a day ahead of plan. Firewall vendors already have rules live.
22 Oct
Agencies warn: update, or take systems offline. Sites go dark as a precaution.
What governments advise
16 agenciesAll say install the fix. They split on what to do if you cannot.
- 2 take offline
- 4 isolate
- 2 offline after other steps
- 6 no offline advice
- 2 not readable