PHP releases updates for serious security vulnerabilities
The foundation behind PHP is tackling critical security problems in widely used web software with limited resources.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Recent security problems in PHP have once again drawn attention to the limited resources of the foundation supporting the programming language. On 21 October, PHP released security updates, while independent reporting points to a small permanent organisation and many outdated installations.
PHP published updates for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the official security advisory, two vulnerabilities could lead to remote code execution without prior authentication.
According to PHP, the problems lie in the handling of memory and internal request data. Under certain circumstances, an attacker could exploit errors that occur when a web server has insufficient memory or reuses old data.
The PHP Foundation supports the language’s development and maintenance, but it is not a large software company itself. According to an interview with the foundation cited by independent technology media, the permanent team consists of one full-time employee, while the organisation also works with fourteen contractors, most of whom work part-time.
That does not mean that only one person maintains PHP. The language is developed by a broader community, and security work is carried out together with external researchers and companies. The limited funding does, however, make it more difficult to free up capacity for maintenance, code review and rapid coordination over the long term.
An additional problem is that many servers run old PHP versions. Tom’s Hardware reports that almost 73 per cent of installations may fall outside official support. That figure comes from an analysis of the security situation and is not an official global register of all PHP servers.
For administrators, the key development is that the security updates are available. The vulnerabilities do not mean that every website has been attacked or that every installation has been taken over immediately. They do show, however, that the security of open-source infrastructure depends both on the community’s maintenance capacity and on organisations updating their systems promptly.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The main technical facts were checked directly against PHP.net. Unofficial estimates about staffing and outdated installations have been presented as reporting rather than as definitive global measurements.
- confirmed PHP released updates on 21 October for four supported versions. — The official PHP security advisory lists versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. source
- confirmed The vulnerabilities could lead to unauthenticated remote code execution. — This is stated in PHP’s official security advisory. source
- confirmed The PHP Foundation has one full-time employee and fourteen contractors. — This staffing figure is mentioned in reporting based on an interview with the foundation. source
- uncertain Almost 73 per cent of PHP installations run on unsupported versions. — This is an analytical estimate from Tom’s Hardware, not an official complete count; it has therefore been phrased cautiously. source
Editor's note
The security updates and vulnerabilities were confirmed by PHP itself. The size of the outdated install base and the number of staff come from independent reporting and have therefore been phrased cautiously.Sources
More on this in Dutch media
- Trouw — „php cybersecurity”
- NU.nl — „php cybersecurity”
- De Telegraaf — „php cybersecurity”