No Widespread Damage Reported from Newly Publicized PHP Vulnerabilities
Tap title to read story
Experts say that, one day after governments warned that severe PHP flaws could force websites offline, there have been few, if any, reports of widespread damage. Across all telemetry, Sophos’ Don Smith noted only a couple of real exploitation attempts. Industry leaders—including CrowdStrike, ESET, Google Threat Intelligence Group, Huntress, Palo Alto Networks, Recorded Future, SecureWorks, Sophos and Trail of Bits—reported to NBC News that, as of Thursday evening, no successful attacks had been observed. The vulnerabilities, affecting an estimated 69% of all websites, were quietly patched after a global effort, and many sites went dark until updates were applied. Cybersecurity experts warn the threat will remain for weeks, if not longer, but early signs suggest the flaws are harder to exploit than initially thought.
More context
Timeline
- 2026-08 — Researchers identified two critical PHP vulnerabilities.
- On October 23 2026 Experts reported no successful exploitation attempts.
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.
