By Tyler Reguly, Associate Director, Security R&D at Fortra
So, you woke up today and everyone is concerned about a vulnerability in PHP… but what does that mean to you?
A remote code execution (RCE) vulnerability in PHP is a big deal. PHP is a web technology that is used to build websites. An RCE is a vulnerability class that allows code (think: malicious software) to be executed on a system remotely. This means that any website with an affected version of PHP could potentially allow attackers to remotely execute code and take control of the system.
To put it into perspective, depending on where you look, PHP has a 70-80% market share. That means if you visit 4 websites, 3 of them are using PHP. If you are having a hard time visualizing that, think about how many people you see daily with black hair, that’s nearly the same percentage of people on the planet that have black hair.
The next thing worth thinking about is supported versions of PHP. Again, depending on where you look, about 35% of sites utilizing PHP versions that are no longer supported. If 3 of every 4 sites you visit are using PHP, then 1 in every 4 sites you visit are out of support. That means they cannot be patched. This long-term usage of unsupported versions of PHP is one of the scarier aspects of this. It means that 25% of websites on the Internet are vulnerable and cannot be fixed, 25% of websites on the Internet are not impacted, and the remaining 50% of websites are currently rushing to apply patches.
When you think about how broad that impact is, you can start to see why everyone is concerned about this… one of the cornerstones of the Internet is vulnerable and that puts everyone at risk.
So, what happens next?
The world has experienced large scale issues like this in the past, so this is not new, we know what the fire drill looks like. This one may be bigger in scope than we’ve seen previously, but we’ve already seen how this is being handled. Websites may go offline for a little bit while patches are applied or systems are updated. Websites that aren’t updated quickly may be breached.
Right now, you may not be able to trust websites you regularly visit to the same degree you normally would. Reach out and ask them if they are impacted and if they have resolved the issue if they are impacted. Look for websites to display notices that they are impacted or that they are updated. Bottom line, be more cautious as you browse the Internet.
Related
This entry was posted on October 22, 2026 at 1:07 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
The PHP flaw puts a cornerstone of the internet at risk as told by Fortra
By Tyler Reguly, Associate Director, Security R&D at Fortra
So, you woke up today and everyone is concerned about a vulnerability in PHP… but what does that mean to you?
A remote code execution (RCE) vulnerability in PHP is a big deal. PHP is a web technology that is used to build websites. An RCE is a vulnerability class that allows code (think: malicious software) to be executed on a system remotely. This means that any website with an affected version of PHP could potentially allow attackers to remotely execute code and take control of the system.
To put it into perspective, depending on where you look, PHP has a 70-80% market share. That means if you visit 4 websites, 3 of them are using PHP. If you are having a hard time visualizing that, think about how many people you see daily with black hair, that’s nearly the same percentage of people on the planet that have black hair.
The next thing worth thinking about is supported versions of PHP. Again, depending on where you look, about 35% of sites utilizing PHP versions that are no longer supported. If 3 of every 4 sites you visit are using PHP, then 1 in every 4 sites you visit are out of support. That means they cannot be patched. This long-term usage of unsupported versions of PHP is one of the scarier aspects of this. It means that 25% of websites on the Internet are vulnerable and cannot be fixed, 25% of websites on the Internet are not impacted, and the remaining 50% of websites are currently rushing to apply patches.
When you think about how broad that impact is, you can start to see why everyone is concerned about this… one of the cornerstones of the Internet is vulnerable and that puts everyone at risk.
So, what happens next?
The world has experienced large scale issues like this in the past, so this is not new, we know what the fire drill looks like. This one may be bigger in scope than we’ve seen previously, but we’ve already seen how this is being handled. Websites may go offline for a little bit while patches are applied or systems are updated. Websites that aren’t updated quickly may be breached.
Right now, you may not be able to trust websites you regularly visit to the same degree you normally would. Reach out and ask them if they are impacted and if they have resolved the issue if they are impacted. Look for websites to display notices that they are impacted or that they are updated. Bottom line, be more cautious as you browse the Internet.
Share this:
Like this:
Related
This entry was posted on October 22, 2026 at 1:07 pm and is filed under Commentary with tags Fortra. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.