PHP Vulnerabilities Exposed: The Channel Reacts

Three partners tell CRN how they’re counteracting the recent PHP vulnerabilities exposed.

The PHP Foundation last week disclosed advance notice of two critical vulnerabilities in PHP, a scripting language that powers approximately 70 percent of the world’s websites.

Google-owned Wiz Research discovered multiple critical vulnerabilities in the code, and according to the vendor, a successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.

Partners were deploying updates immediately due to the severity of the risks.

Basem Al-Sabri, founder at Netomate told CRN vendors are sending out “serious” messaging to partners.

“We’re receiving advance notice through partner channels that critical security updates are coming and should be applied immediately,” he said.

Al-Sabri said the vulnerabilities are so severe that vendors aren’t giving out specifics on what has been impacted in their backends.

"When they release the details it increases the attack vector,” he said,

"That gives attackers more information on how to exploit these vulnerabilities.”

Al-Sabri said they will be informing their customers about the updates.

“Any upgrade that affects availability goes through our change process. We notify customers in advance of the window and the expected impact,” he said.

“When it’s something like this, we explain why it needs to happen now rather than in the usual one or two weeks.”

One of the issues with this new vulnerability is that it’s not a single patch and move on event, according to Dan Cox, managing director – cloud at Interactive.

“There can be multiple rounds of testing, validation and implementation as vendors continue to release updates,” he said.

“A big part of our role is helping customers navigate that process, understand what action is required, and remediate.”

A broader lesson from this incident is the importance of supply chain visibility, Cox noted.

“Patching PHP directly is relatively straightforward,” he said.

“However, the greater challenge is understanding where PHP may sit within third-party applications, platforms and services and waiting for those vendors to release fixes. In some cases, organizations were forced to take applications offline.”

Michael Demery, founder and managing director at MSSP Seccom Global, said the underlying weaknesses had existed for years, and warning signs around one of them were identified in 2024.

“What matters is that researchers used AI to help discover how those weaknesses could become practical attacks,” he said.

“That matters because it shows not only how attackers can now use AI to find ways to exploit known vulnerabilities, but also how AI can be a powerful defense tool.”

It would be wrong to assume that affected organizations simply failed to maintain their systems, Demery explained.

“The emergency fixes only became publicly available this week, so even organizations that were fully up to date beforehand could potentially have been vulnerable,” he said.

“This type of attack shows that regular patching remains essential, but the ability to assess and deploy urgent security updates quickly in today's AI-driven world has become critical. A good MSSP can provide this.”

Demery noted that the speed at which this issue emerged publicly also shows why businesses must maintain protected backups of their websites and databases and regularly test recovery.

“A vulnerability can exist for years without most organizations knowing about it, while an attacker who knows about it may be quietly developing an exploit,” he said.

“This is why website monitoring should alert on unexpected changes to files, settings, and administrator accounts. A compromised website can still appear to operate normally, so simply checking that it is online is not enough.

“For businesses, the immediate priority is to identify where PHP runs on their website and confirm that the relevant fixes have been applied.”

The status of this vulnerability was still critical as of this writing.

This article originally appeared on CRN sister website CRN Australia.