PHP and Wiz researchers coordinated disclosure. Google Cloud says PHP 5.4 through 8.5.11 is affected, with fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and do not receive these project fixes.

The invisible component underneath a site

PHP may sit in web servers, containers, serverless functions and embedded administration panels.

Organisations can use it without a complete inventory. Test environments and old images may also differ from production.

Patching is not one click

Managed platforms may patch supported images automatically; other environments must be rebuilt and redeployed.

Linux distributions may backport a fix while keeping an older-looking version number, so teams should rely on vendor advisories rather than superficial comparisons. Updating WordPress or another CMS is therefore not necessarily enough.

Prioritise exposure, not improvisation

Internet-facing services and systems processing sensitive data come first. Teams should preserve logs, follow vendor detection guidance and validate redeployment.

A web application firewall may reduce exposure but does not replace a patch. End-of-life systems require migration or carefully documented temporary controls.

Une alerte sur la dette technique

The flaws do not prove every PHP site was compromised.

Conclusion

The flaws do not prove every PHP site was compromised.