Two critical vulnerabilities have been discovered in PHP, the programming language powering around 70% of websites, potentially putting businesses and internet users at risk.
Voldemaras Kadys, Head of Security & Platform Engineering at Mediatech, explains what these flaws mean for websites, how ordinary internet users could be affected, and why the release of security updates doesn’t necessarily mean websites are safe. Please find Voldemaras’s comments below:
What is PHP?
“PHP is a programming language that powers around 70% of all websites, including online services, stores, booking platforms, and many others. In other words, most websites you browse online are based on PHP and are therefore affected by the recent vulnerabilities.”
What were the flaws in it and why was an update needed?
“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline. The potential impact of these vulnerabilities may be huge, as most websites run on PHP.
PHP developers have already issued updates for these vulnerabilities, but that doesn’t mean all websites are automatically safe – website operators and hosting providers need to install the updates themselves, and hopefully they do that as soon as possible. The seriousness of the vulnerabilities is also evident from the fact that PHP released updates even for End-Of-Life (EOL) PHP versions, which are no longer actively supported and typically do not receive any more updates.”
Do regular web users need to worry?
“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised. The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.
This kind of information may then be used for phishing, impersonation or other scams. However, not every PHP-powered website is vulnerable, and the vulnerability alone does not instantly mean a breach has happened.
There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites.”
Related
This entry was posted on October 22, 2026 at 9:10 am and is filed under Commentary with tags Cybernews. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
What the PHP flaws mean for regular internet users
Two critical vulnerabilities have been discovered in PHP, the programming language powering around 70% of websites, potentially putting businesses and internet users at risk.
Voldemaras Kadys, Head of Security & Platform Engineering at Mediatech, explains what these flaws mean for websites, how ordinary internet users could be affected, and why the release of security updates doesn’t necessarily mean websites are safe. Please find Voldemaras’s comments below:
What is PHP?
“PHP is a programming language that powers around 70% of all websites, including online services, stores, booking platforms, and many others. In other words, most websites you browse online are based on PHP and are therefore affected by the recent vulnerabilities.”
What were the flaws in it and why was an update needed?
“Two critical security flaws were discovered in PHP that could allow hackers to take control of vulnerable website servers and potentially steal customer information, change website content, install malware or take the website completely offline. The potential impact of these vulnerabilities may be huge, as most websites run on PHP.
PHP developers have already issued updates for these vulnerabilities, but that doesn’t mean all websites are automatically safe – website operators and hosting providers need to install the updates themselves, and hopefully they do that as soon as possible. The seriousness of the vulnerabilities is also evident from the fact that PHP released updates even for End-Of-Life (EOL) PHP versions, which are no longer actively supported and typically do not receive any more updates.”
Do regular web users need to worry?
“For regular internet users, simply visiting a PHP website doesn’t necessarily mean their device will be compromised. The risk is that attackers may exploit a website that holds their personal information. For example, if a user has an account with an online shop, attackers may be able to hack that website through this PHP vulnerability and extract the information the user has stored there, such as their email address, physical address, name and date of birth.
This kind of information may then be used for phishing, impersonation or other scams. However, not every PHP-powered website is vulnerable, and the vulnerability alone does not instantly mean a breach has happened.
There’s no reason to stop browsing or shopping online, but users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites.”
Share this:
Like this:
Related
This entry was posted on October 22, 2026 at 9:10 am and is filed under Commentary with tags Cybernews. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.