The Ministry of Industry and Information Technology's cybersecurity threat and vulnerability information sharing platform (NVDB) has issued an urgent alert regarding two extremely critical remote code execution vulnerabilities in PHP. Attackers can directly infiltrate target systems without any authentication, and relevant organizations and users are advised to immediately investigate and upgrade to the latest secure version.
These vulnerabilities have an extraordinarily wide reach, as roughly seventy percent of websites worldwide rely on PHP for their underlying operations. From government services to financial institutions, all face direct security threats. Cybersecurity firm Cloudflare disclosed that millions of exploitation attempts have been detected since the vulnerabilities were exposed. Amazon stated that hackers had already begun attempting to exploit the flaw four days before it was publicly disclosed.
In terms of response, Finland, France, and the Netherlands were among the first to proactively take certain government services offline. Multiple Japanese airlines, financial institutions, consumer goods companies, and gaming enterprises successively announced service disruptions. Alibaba Cloud and Tencent Cloud also issued emergency warnings after the incident came to light, urging customers to complete version upgrades as soon as possible.
No Login Required to Exploit, Severity of Vulnerabilities Is High
The core risk of the two exposed vulnerabilities lies in the extremely low barrier to entry for attackers. Unauthenticated attackers can directly launch attacks on servers running PHP, remotely executing arbitrary code, which can lead to server takeover, leakage of sensitive information, and business disruption.
The affected PHP version range is broad, including: the 8.5 series below 8.5.12, the 8.4 series below 8.4.27, the 8.3 series below 8.3.36, the 8.2 series below 8.2.35, as well as the 8.1 series and earlier versions.
The vulnerabilities were discovered by researchers from two U.S. cybersecurity firms, Calif and Wiz, and were only identified with the assistance of AI models from OpenAI and Google. Notably, the vulnerability had been latent in the system for over a decade.
In its risk advisory, the MIIT clearly outlined response priorities: relevant organizations and users should immediately conduct comprehensive investigations and promptly upgrade to the latest secure version officially released by PHP.
For organizations unable to complete upgrades in the short term, officials recommend temporary protective measures such as taking services offline, disabling the session upload progress feature, network isolation, or access restrictions. At the same time, they should strengthen cybersecurity monitoring and promptly replace credentials such as account numbers, passwords, and keys.
Multiple Countries Choose Proactive Shutdowns to Trade Time for Security
As one of the most widely used server-side scripting languages globally, PHP provides foundational support for internet infrastructure. Cybersecurity firm Wiz estimates that the affected PHP language drives approximately seventy percent of websites worldwide, including the website-building platform WordPress.
This scale means that everything from personal blogs and small business websites to government public service platforms potentially falls within the scope of attackers' targets. The U.S. National Security Agency (NSA) and European cybersecurity agencies have successively issued warnings, urging enterprises to take immediate action.
Facing the rapid surge in exploitation attempts following the exposure of the vulnerabilities, multiple governments and enterprises have chosen to proactively shut down related services.
In Europe, Finland, France, and the Netherlands took the lead in precautionarily taking certain government services offline. The Australian Signals Directorate issued a warning late Wednesday night, urging enterprises and users to update patches as soon as possible, though some government websites still became inaccessible as a result. In the Asia-Pacific region, South Korea raised its private sector cyber crisis alert level and convened an emergency meeting with officials from the Ministry of National Defense, the Ministry of Science and ICT, and the National Intelligence Service.
In Japan, airline All Nippon Airways (ANA) announced the suspension of its website and application services, including the Apple Wallet boarding pass feature. Nomura Securities' subsidiary and Mitsubishi UFJ (MUFG) suspended certain non-core services, with Mitsubishi UFJ stating that the shutdown would not affect payment operations. Japan's largest brewer Asahi Group, railway operator Keihan Holdings, and gaming companies Sega and Bandai Namco also successively announced emergency maintenance or suspension of certain functions on their websites.
SMEs and Ordinary Users Also Under Pressure
Although the vulnerabilities have drawn widespread attention, some professionals note that the actual risks faced by different types of organizations vary significantly.
Monash University scholar Rashina Hoda stated that large banks and enterprises typically do not rely on PHP for sensitive transactions, so the direct impact on them is relatively limited. However, a large number of small and medium-sized enterprises that heavily depend on website-building platforms like WordPress have PHP as the underlying foundation of their websites, and these businesses will face more urgent remediation pressure.
Hoda also warned that the exposure of these vulnerabilities could trigger a surge in online fraud and phishing attacks. Attackers often exploit major security incidents to create panic, inducing users to click on fake "patch links" or submit account information.
Comments