CONNECT WITH US
Web3 & Blockchain

Web3 & Blockchain

PHP Foundation admits ‘structural failure’ delayed critical security fix

Cointelegraph logo

Published on

Add as a preferred source on Google
PHP Foundation admits ‘structural failure’ delayed critical security fix

Government websites and online services were disrupted after concerns about a PHP bug that could allow attackers to take control of vulnerable servers.

The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”

Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.

PHP is a programming language widely used to power websites and web applications, including content management systems.

In a blog post following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.

“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months,” said the foundation.

“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”

The foundation was pointed to the vulnerability again on August 11, after security firm Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution, which made it a top security priority.


Source link
Related Topics:Web3 & Blockchain

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.