PHP powers a huge part of the internet. It’s the engine behind millions of websites, blogs, online stores, and more. Most people never see it, but it’s working behind the scenes on a lot of the pages you visit.
A simple comic about the recent big PHP security problem
PHP powers a huge part of the internet. It’s the engine behind millions of websites, blogs, online stores, and more. Most people never see it, but it’s working behind the scenes on a lot of the pages you visit.
Researchers found serious holes deep inside PHP itself. These problems had been sitting in the foundation of the engine for a long time. They weren’t in a specific website or plugin — they were in the core software that runs the sites.
Attackers don’t need a password. They can send a specially crafted request (like a weird form or file upload) that confuses the server. This can let them run their own code on the website’s server.
Once inside, attackers can take control. They may steal data, change the website, or cause other problems. After the issue became public, sites around the world saw large numbers of attack attempts, and some even went offline temporarily to protect themselves.
The fix is to update PHP. The PHP team released patches quickly. Updating to a fixed version seals the holes so the sneaky requests no longer work. There’s no complete temporary workaround — updating is the real solution.