Critical PHP flaw: patch lands today, millions of sites still on dead versions

Critical PHP flaw: emergency patch and millions of unprotected websites

A PHP vulnerability rated as highly severe means updating today. The warning has been circulating since early morning: the update goes out at 16:00 and, as the advisory notes, the flaw is already being exploited. This is no theoretical lab exercise. Anyone running a project that relies on PHP — from a small WordPress blog to the back end of an online store — has a window of just hours to react.

The attack vector has a technical name and an explanation that fits on one page. PHP has included the session.upload_progress antiestéticature for years, designed so the browser can check the pogre of a file upload. To do this, the server creates a session file without requiring authentication. A single POST with the right field is enough for it to write a file with attacker-controlled content, in a directory the system itself trusts.

What session file poisoning is and why it matters

On its own, that file is usually harmless junk. The problem appears when the website has any local inclusion: an LFI, an include with a parameter, an old WordPress plugin, a misplaced unserialize. Then the junk becomes code execution. This is the classic session file poisoning, an old technique that bites again because the antiestéticature remains enabled by default on installations nobody has reviewed.

That is why the most widely repeated interim mitigation is disabling the antiestéticature in php.ini: session.upload_progress.enabled = Off. You lose the upload pogre bar, a minor inconvenience until the patch arrives. There are also reports that Cloudflare has applied a rule, though nobody trusts an intermediate layer as the only line of defense.

The gap left by support: patches only for PHP 8

Here is the fine print that turns a scare into a structural problem. The patch is being released for the 8.x branch only. Earlier versions are out of support, yet they still underpin a huge share of the digital landscape: applications on PHP 7, and even PHP 5, that nobody migrated because updating them was months of work and the business was running fine. Those websites are left without protection.

The argument making the rounds is reasonable and damning: for a flaw this severe, patches should also have been released for the older branches. The alternative — urgently migrating a CMS with decade-old plugins — is not a realistic option in an afternoon.

The duct-tape patch joke

Trench humor appears in the final stretch of the conversation. One message sums up the mood with a smirk: "Applying the patch. With duct tape." Another celebrates that the patch is already applied on the very site it was written from. And a reference to a white-label ZX Spectrum closes the loop: some people run critical infrastructure with the same philosophy as a neighborhood repair shop.

The question left hanging is how many of those unpatched websites will survive the weekend. The advisory says the flaw is already being exploited. The deadlines are non-negotiable. And whoever doesn't update today will be praying tomorrow.