Google Analytics counts our visits, with cookies. No thanks turns it off and removes its cookies; in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, it stays off unless you accept. Cookie Notice

Advertise
PRICES
BTCETHSOLXRPBNBTONDOTLTCPOLHBARNEARARBUNI

← Back to NewsDesk

AI summary of a third-party reportBearishNewsDesk

PHP Foundation says resource shortfall delayed critical security fix

The PHP Foundation has called its slow response to a critical flaw first spotted in 2024 a "structural failure", as governments and crypto firms took sites offline while emergency patches were issued.

InvestIn.News NewsDesk · 1 min read
Share
Picture from Cointelegraph for: PHP Foundation says resource shortfall delayed critical security fix
Image: Cointelegraph
Original reporting: Felix Ng, Cointelegraph

Key points

  • The foundation says work on a fix stalled and restarted over months after the flaw was first seen in 2024.
  • Calif and OpenAI independently reported the same issue on 11 August, with Calif demonstrating remote code execution.
  • SlowMist found 793 domains with direct PHP fingerprints among 1,488 assessed across the crypto industry.

The PHP Foundation has acknowledged that a critical security fix was delayed by indecision and thin resources, describing the stalled response as a "structural failure". The admission came in a blog post after PHP released emergency patches for two related critical vulnerabilities that could let unauthenticated attackers run code on affected servers. Government agencies and other organisations worldwide took websites offline on Wednesday as a precaution.

The foundation said its developers first saw signs of the vulnerability in 2024 but struggled to find a solution that would not disrupt the large ecosystem built on PHP. It said the lack of a known route to remote code execution, combined with a small team of core developers busy with other duties, meant work on a fix repeatedly stalled and restarted.

The disruption spread across the world.

In crypto, SlowMist urged exchanges, DeFi platforms and wallet providers to check their exposure, while Intersect took its Cardano Members Area offline.

What to watch: The PHP security team has released emergency patches, and operators are being urged to apply them as quickly as possible.

Read the full story on Cointelegraph

Live updates on NewsFeeds:AltcoinsDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)

How this was produced: an AI model wrote this summary of Cointelegraph’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.

Not investment advice. Read the risk disclaimer.

← Back to NewsDesk