Critical PHP Vulnerabilities Threaten California Websites: Emergency Patches Coming
Two critical security flaws in PHP are triggering emergency alerts right now, and California businesses running websites or web apps on affected PHP versions need to pay attention. The vulnerabilities carry a CVSS score of 9.2 out of 10, which is about as serious as it gets, and patches haven't even dropped yet.
Related: What Was California's Golden State Stimulus - and Why Those Checks Stopped Coming · How to Sign Up for Sierra County Emergency Alerts and What to Expect When a Warning Goes Out
According to early reports, the flaws are remote code execution (RCE) bugs, meaning an attacker could potentially take over a vulnerable server from anywhere on the internet. The EU's cybersecurity agency is warning that some websites may need to be pulled offline entirely until fixes are in place. PHP says it plans to release two emergency patches imminently.
This is a developing story. Details, including exactly which PHP versions are affected and when the patches land, may change as updates come in.
Why California Should Care
PHP powers a massive chunk of the web, from small business sites to large e-commerce platforms. California is home to thousands of tech companies, startups, and digital storefronts that rely on PHP-based systems. If your IT team or web host hasn't flagged this yet, now's the time to ask. Until those patches are live, any exposed PHP installation is a potential open door.
See also: How to Sign Up for Mariposa County's Emergency Alerts - and Why It Matters More Here Than Almost Anywhere in California · El Niño Emergency Declared in California: What You Need to Know Right Now
What We Know Right Now
The flaws are being tracked under the name "PHP2Shell" according to The Hacker News. Two separate vulnerabilities, both rated critical at CVSS 9.2, are unpatched as of this writing. An emergency security alert has gone out to the wider tech community, and the PHP team is racing to get fixes published. Reuters reports the EU agency is advising site operators to weigh whether taking affected services offline temporarily is the safer call.
What To Do Now
If you manage a website or web service, check with your hosting provider or IT team immediately about your PHP version and whether you're exposed. Watch the official PHP security channels for patch announcements, which could come at any time. Don't wait for patches to land before you start assessing your exposure. This story is still breaking and CALWIRE will update as more details are confirmed.