PHP Hit by a 9.2-Severity Flaw: 40% of the Web May Be Affected, and the Patch Can't Auto-Install
Lots of websites are wary of taking visitors today. Not because of traffic — because of a 9.2-severity flaw whose patch is out, but most site owners don't know who's supposed to install it.
Three key facts
On October 21, PHP published a security advisory fixing two critical vulnerabilities allowing unauthenticated remote code execution, with a severity rating of 9.2 out of 10. Affected versions cover nearly every PHP release since PHP 5. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; the project strongly urges all users to update immediately.
This isn't a problem for a few people — it's a problem for the entire web. According to The Verge, one security researcher estimates more than 1.3 million internet-connected hosts are likely affected. More critically, WordPress: Wordfence warned that every WordPress site is vulnerable because they all run on PHP servers, and WordPress reported last year that it powers more than 40% of the internet.
The killer detail: the patch cannot be installed via automatic updates. Wordfence explicitly warned that site owners must figure out who is responsible for updating PHP and apply the patch manually. The EU CERT and UK NCSC have both issued advisories recommending that companies unable to patch immediately isolate internet-facing apps or take them offline entirely; GrapheneOS has temporarily taken its user forum offline, with a very practical reason — proof-of-concept exploits are already being developed, and they "don't want to take the risk."
Wang Dou's Take
Start with "can't auto-update." That's the most absurd sentence in this whole story. A flaw rated 9.2, covering 40% of the web, letting someone run their own code directly on your server — and the official fix is "please go install it manually yourself." WordPress plugins update with one click, WordPress core updates with one click, but the foundation underneath them — many people don't even know which machine it's on.
This is what technical debt really looks like: not some abstract ledger entry, but a concrete question — "who at your company is responsible for patching PHP?" Most companies answer with silence. Because PHP isn't anyone's KPI; it's the thing that "keeps working so nobody manages it."
Now look at the timeline. Advisory out October 20, patch installed October 21, and security researchers already expect "mass attacks within 15 minutes of the release." That's not alarmism — it's the norm for modern vulnerabilities: the patch and the exploit code go live almost simultaneously, and that gap is the window during which everyone unprepared gets harvested.
So the real conclusion of this piece isn't "go upgrade PHP." It's this: your security posture equals the longest accountability chain you have. When anyone on that chain says "that's not my job," the whole system is effectively unpatched.
Source: PHP Official Security Advisory · The Verge