PHP security patches released for serious flaws as website operators move to protect their systems

Two serious security vulnerabilities in PHP, a technology used by a large number of websites, have prompted institutions and organizations in several countries to temporarily disable some of their online services. Security patches have been released, and Croatia's National CERT recommends urgently updating affected servers.

PHP is used by many news websites, online stores and sites built with systems such as WordPress. Its widespread use means the issue needs to be taken seriously, but it does not mean that most of the internet has been attacked or that every website using PHP is vulnerable.

According to the reports provided, the vulnerabilities could, under certain conditions, allow attackers to run commands on vulnerable servers or access some data stored in server memory. Attempts to exploit the flaws were also reported before the patches were publicly announced. However, an attempted attack is not the same as a successful breach, and the reports do not establish that every affected system has been compromised.

Some online services in Finland, the Netherlands and the United Kingdom, as well as auxiliary services operated by the Wikimedia Foundation, were temporarily disabled as a precaution. These shutdowns do not, by themselves, mean that the organizations were successfully hacked.

For ordinary users, there is no reason to conclude that their phones, computers or accounts are automatically at risk simply because they visit websites that use PHP. The main responsibility lies with website owners and service providers, who need to check their systems and install the appropriate security patches. Users do not need to install PHP themselves. As always, be cautious of messages that exploit fears about security flaws to trick people into revealing passwords or other personal information.

This is a serious security issue that requires prompt action from system administrators. However, temporary website shutdowns are not proof that the internet as a whole is down or that all users are at risk.