Global alert issued as critical PHP security flaws discovered

Governments and cybersecurity agencies across multiple countries have issued coordinated warnings following the discovery of two critical security flaws in PHP, one of the most widely deployed programming languages powering websites and web applications globally.

The vulnerabilities, which were disclosed after a patch was released Wednesday afternoon, pose significant risks to organisations reliant on PHP-based systems. Cybersecurity experts have characterised the flaws as serious threats requiring immediate remediation across affected infrastructure.

International agencies have urged organisations to prioritise applying the security update as quickly as possible. For those unable to deploy fixes immediately, authorities have recommended considering temporary shutdown of vulnerable systems to prevent potential exploitation by malicious actors.

The incident underscores the critical importance of timely software patching and security updates in maintaining the integrity of digital infrastructure. With PHP powering a substantial share of web-based services, including numerous platforms essential to businesses and government operations, the vulnerabilities' discovery has prompted widespread mobilisation across the cybersecurity sector to ensure rapid remediation globally.

Organisations in Sri Lanka, particularly those operating e-commerce platforms, financial services, and government digital services, have been advised to verify their systems and apply necessary updates without delay.