PHP vulnerabilities trigger a global patching scramble as exploitation begins

Two long-dormant PHP vulnerabilities allow unauthenticated remote code execution on unpatched internet-facing systems, potentially giving attackers control without a password or user interaction. Coordinated disclosure helped many large providers prepare patches, but researchers have detected exploitation before and after public release, with confirmed compromises reported. PHP’s broad use across websites, developer tools and network devices leaves smaller operators and legacy systems exposed for longer. The incident also highlights the security burden of ubiquitous open-source software and the limits of AI-assisted vulnerability discovery.














