Critical PHP flaws demand urgent patching, cyber expert warns

Businesses running internet-facing PHP applications face a heightened risk of server compromise following the disclosure of critical vulnerabilities in the scripting language, according to Zain Javed, Director of Strategic Growth and Cyber Services at Citation Cyber. The flaws, which can in certain configurations allow an unauthenticated attacker to execute code remotely on a server, affect a broad range of platforms including WordPress, Drupal and Joomla, as well as bespoke applications that organisations may not recognise as PHP-dependent.

Javed said the core challenge for security teams is not simply applying an update, but first knowing where every PHP instance exists across their estate. "You cannot patch something you don't know you have," he said, pointing to old websites, legacy systems, development environments and third-party products as common blind spots.

The shrinking exploitation window

The timing pressure is acute. Javed noted that once details of a working exploit become public, attackers begin scanning the internet within hours. "The window between disclosure and mass exploitation is getting smaller," he said. Critically, patching alone is not sufficient: organisations should also review logs predating the update, checking for suspicious requests, unexpected processes, newly created accounts or unusual outbound connections that could indicate a server was already compromised before the patch was applied.

For organisations that cannot remediate immediately, the NCSC has advised that taking the affected service offline should be considered. Javed acknowledged that this is a difficult decision for businesses reliant on public-facing services, but framed it as a risk-based call rather than an overreaction. "Taking a service offline can be the responsible decision," he said, adding that recovering from a full server compromise or ransomware incident is typically far more disruptive than planned downtime.

Smaller businesses using managed hosting or web agencies should not assume they are insulated. Javed urged SMEs to ask their hosting provider or developer directly which PHP version is running and whether the security update has been applied. Responsibility for underlying infrastructure is often unclear in these relationships, and that ambiguity creates risk.

AI accelerates the threat cycle

The vulnerabilities carry an additional dimension that Javed described as the most significant part of the story: the role of AI in accelerating exploit development. The flaws reportedly existed within PHP for more than a decade before frontier AI models helped researchers understand them and develop working exploits at a speed that would previously have been impractical.

Javed was careful to note that AI is not creating new vulnerabilities, but it is compressing the timeline for finding, understanding and weaponising them. On the defensive side, the same capability allowed researchers to identify the flaw, work with PHP maintainers and produce a patch before widespread exploitation was known to have occurred. The concern is whether that same speed advantage will shift to attackers as AI tooling becomes more accessible.

Market and regulatory context

PHP remains one of the most widely deployed server-side languages on the internet, which means the blast radius of any critical flaw is unusually large. The cybersecurity industry has long grappled with the asset-visibility problem: organisations often lack a complete inventory of the software running across their infrastructure, particularly for legacy or third-party components.

From a regulatory standpoint, UK organisations subject to NIS2 read-across obligations or sector-specific frameworks such as Cyber Essentials are expected to maintain timely patching processes and incident-detection capabilities. A failure to patch a publicly disclosed, actively exploited vulnerability in a timely manner could draw scrutiny from regulators in the event of a subsequent breach. The EU's NIS2 Directive, which came into force in October 2024, places explicit requirements on member-state entities around vulnerability handling and incident reporting timelines, raising the compliance stakes for European operations as well.