Security experts have warned that critical PHP vulnerabilities could expose websites to server compromise and follow-on fraud. The flaws have prompted some organisations to take websites offline.

The issue centres on two vulnerabilities that researchers said could allow attackers to execute code remotely on vulnerable PHP servers. Because PHP is widely used across the web, businesses that rely on it for customer-facing services could face broad exposure.

Akamai researchers said the vulnerabilities affect PHP's built-in file-upload functionality and could expose endpoints that accept uploads, even when an application does not actively process the files. They added that the flaws highlight how difficult it has become for security teams to identify exposed systems and apply patches quickly enough.

If systems are compromised, businesses face immediate operational risks, including website outages, theft of data and credentials, and the possibility of attackers moving from one server into wider corporate environments.

For retailers, the concern extends beyond the initial disruption. If attackers gained access to customer data or account credentials during the window of exposure, the effects could continue long after websites are restored.

The risk is especially acute ahead of peak shopping periods, when higher transaction volumes can make fraudulent activity harder to detect. Criminals who gain access to genuine customer accounts can misuse stored payment details, loyalty points, or store credit. They may also change delivery details and redirect orders.

The commentary also points to a wider shift in cyber risk. Security researchers and vendors have increasingly linked AI tools to faster vulnerability discovery and quicker weaponisation of newly disclosed flaws.

Source link