Update now: serious security flaws found in PHP, which runs many websites

Patches are out for supported versions. Australia's cyber agency says it is not aware of the flaws being used in attacks.

Confirmed

Serious security flaws have been found in PHP, a programming language that runs many websites. The PHP team has released fixes. It urged all users to update straight away, iTnews reported. The two flaws are rated 9.2 out of 10 for how severe they are. Details leaked online before the planned release date. PHP powers popular website tools such as WordPress, Drupal and Magento. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions, 8.1 and below, have no fix from the PHP team. The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) issued an alert on Wednesday. It said it is "currently not aware of active exploitation". That means it has not seen the flaws used in attacks. The United States cyber agency has not seen attacks either. One security company, Hadrian, claimed the flaws are being used "at scale". Whether attacks are really happening is not yet known. If you run a website, ask whoever looks after it to check its PHP version.