PHP Security Flaw Temporarily Disrupts Government Sites as Crypto Firms Check Exposure

A security vulnerability in PHP, the programming language used to build websites, has been found to let outside attackers remotely control servers. Governments in several countries temporarily suspended some web services to apply patches and conduct checks, while cryptocurrency companies reviewed whether they were exposed.

Cointelegraph reported on October 22 that the PHP Foundation disclosed why its response lagged even after it released an emergency patch. The foundation said patch work was repeatedly halted for months because of the security team's decision-making process and a lack of resources. It described the delay as a structural failure.

The vulnerability involved two flaws that could allow unauthenticated attackers to execute arbitrary code on servers. The foundation said it detected related signs in 2024, but a fix was delayed as it weighed the impact on the broader PHP ecosystem. The issue became a higher priority in August after security firm Calypt and OpenAI each reported the vulnerabilities and demonstrated that real-world attacks were possible.

The government service suspensions were preventive and did not follow confirmed attacks. The Netherlands' digital identity service and National Cyber Security Centre website, along with Finland's public government web services, were temporarily taken offline. France and Germany also suspended some government websites.

In the cryptocurrency industry, Coinbase and BitGo disclosed the results of their reviews. Coinbase Chief Security Officer Jeff Lunglhofer said the company conducted a full review as soon as it learned of the vulnerability and found no exposed PHP instances. BitGo also said its platform was unaffected.

Changpeng Zhao, Binance's co-founder, said some websites may still not have applied the patch and urged users to be cautious when visiting websites over the next few days. The PHP security team said it had not confirmed any cases of active exploitation as of the public disclosure.