Widespread PHP Vulnerability Triggers Site Outages, Urges Immediate Patching

Security researchers have identified two critical vulnerabilities in the PHP programming language that are being exploited in the wild. The flaws allow an attacker to execute arbitrary code and take full control of any server running an unpatched version of PHP, leading to widespread site outages and the appearance of "404 – Page Not Found" errors.

The vulnerabilities affect the core PHP engine and are present in versions used by an estimated 70 percent of web sites worldwide. Exploits are already circulating, and early reports indicate that attackers are using them to hijack servers, install back‑doors, and deface or redirect traffic.

Web administrators are being urged to apply the official patches released by the PHP development team without delay. In addition to updating the PHP runtime, experts recommend reviewing server logs for suspicious activity, rotating compromised credentials, and scanning for unauthorized files that may have been dropped during an intrusion.

Australian small and medium‑size enterprises are particularly at risk, as many rely on PHP‑based platforms such as WordPress, Joomla and Drupal for their online presence. A breach could not only disrupt operations but also breach the Australian Privacy Principles, exposing businesses to regulatory penalties and loss of customer trust.

The immediate steps for Australian businesses are to verify the PHP version in use, apply the security updates released today, and consider engaging a trusted IT support provider to perform a comprehensive security review. Prompt patching is the most effective defence against the current wave of exploitation.