What happened

PHP's maintainers announced that patches for two vulnerabilities will be released in a little more than 12 hours. Both flaws are rated 9.2 out of 10, a level of severity well above routine bug fixes.

A call to users

The advisory encouraged all PHP users to prepare now so they can upgrade as soon as the release is available. Maintainers also reserved the right to release earlier if details of either vulnerability become public or evidence of active exploitation appears in the wild.

Why it matters

PHP powers a large share of websites and web applications, so a flaw of this scale affects many sites at once rather than a single company.

What admins should do

  • Plan your update process in advance so you can apply the patch quickly.
  • Review PHP-based application versions and dependencies.
  • Watch suspicious traffic and access logs more closely until the patch lands.