Two Critical PHP Bugs Expose 70% of the Web to Server Takeover

The pre-patch exploitation is the real story here: it means the disclosure-to-patch window was already a live attack surface, and government systems going offline signals that some operators judged the risk too high to wait. Because PHP underpins so much of the web's shared infrastructure, this is less a single-vendor problem than a systemic exposure concentrated in organizations that patch slowly. The open question is how many of the affected deployments are still unpatched, and whether the early attacks were targeted or opportunistic — that distinction will shape how the fallout is read.