Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
Do I need to change my passwords?
How it was asked: The Times' standfirst mentions stolen passwords.
The short answer
Not because of this, as things stand. The flaw is on web servers, not on your devices, and no site has announced a breach through it. If a site you use announces one, follow its instructions. Using a different password on every site is the protection that holds whatever the next flaw is.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/passwords/index.html
The answer, with its sources
The flaw is on the server. Both bugs are in the PHP engine that runs on web servers; nothing on a reader's computer or phone is affected or needs updating for this. php/php-src, read from a clone php.net
What an attacker could reach on a compromised server is whatever that server holds, which can include a site's user database. That is why the agencies treat it as urgent. But no organisation has confirmed a compromise through php2shell. CISA CISA Huntress
This is the site's reading, not an agency's advice: none of the captured advisories tells the public to change passwords. If a service you use announces a breach, its notice is what to act on. NCSC UK CISA
The pages that carry it
Next question: How do I know whether my site is affected? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.