Two critical PHP flaws trigger global alert; millions of services face cyber risk

The open‑source scripting language PHP, which powers a large share of websites and online applications, announced a temporary mitigation on October 23. Developers were instructed to turn off the session upload progress feature, a tool that allows users to see the status of file uploads, until the next scheduled bug‑fix release. The advisory explained that the feature could be abused when certain session settings are altered, creating a pathway for attackers to execute arbitrary code or gain unauthorized access to server resources. The guidance was issued as part of PHP’s regular security update cycle.

The earlier advisory on October 21 highlighted a related flaw that could be triggered under specific configuration conditions. Together, the two vulnerabilities affect applications that rely on custom session handling, a common practice in e‑commerce platforms, content management systems and custom web portals. Security researchers warned that the combined effect could allow malicious actors to bypass authentication checks or inject malicious payloads into active sessions. The risk is amplified for sites that have not applied recent patches or that run older PHP versions.

For readers in India, the alert is significant because a large number of domestic startups, online retailers and government portals use PHP for their digital services. A successful exploitation could lead to data breaches, financial loss and erosion of user trust. Organizations are advised to follow the temporary disablement recommendation, review their session configuration, and apply the forthcoming security update as soon as it is released. Keeping software up to date remains a core defense against evolving cyber threats.