Remotely exploitable PHP bug found on 70% of world’s websites

A bug that allows hackers to remotely execute code has been discovered in PHP, the language that powers 70% of the world’s websites. PHP shipped emergency fixes today for two of the most critical flaws, but over one-third of the web remains unpatched as of publication time. The language, used to program website backends, runs on servers, not in the browser, and sends its resulting HTML or other dynamic data to the browser. Official fixed releases only cover PHP 8.2 and newer, leaving over one-third of PHP websites without a patch. Mid-day, backports were starting to roll out across older versions 7.4-8.1.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Protos.