The first signs of a security vulnerability in PHP, used in many internet systems, emerged in 2024. Delays in patching and disruptions in the release process have been revealed.
While the critical vulnerability in PHP, one of the cornerstones of the internet, has turned into a crisis, the official statement published by the PHP Foundation revealed significant shortcomings in the management of the serious security vulnerability process in PHP. It was stated that the first signs were detected in 2024 during a security audit financed by the German government, and the delay of months in the fix brought to light issues that the foundation itself described as “structural failures.”
The process surrounding the PHP security vulnerability also led to controversy during the patch release phase. According to information shared on social media, details of the vulnerability were leaked online on October 20th. It was alleged that a security company accidentally published a video demonstrating an attack scenario, and a company named Chainguard violated the embargo by sharing the fix more than six hours before other announcements.
PHP's Security Relies on a Limited Number of Developers
One of the most striking aspects of the discussion is the limited size of the developer team responsible for PHP's security. The post, citing the PHP Foundation's statement, emphasizes that the security of the language, used globally by banks, online stores, and public services, relies on a small group of developers.
As PHP is one of the most widely used programming languages in internet infrastructure, delays in addressing security vulnerabilities can lead to widespread risks. Keeping systems used by public institutions and critical services up-to-date is particularly important to prevent the exploitation of such vulnerabilities.
Following the critical vulnerability in the PHP infrastructure, some public services were forced to disable their systems. The consequences of this escalating crisis are a matter of great concern.
0 Comments: