PHP patches may not end security risks for months, experts warn

Security updates for vulnerabilities in PHP will not immediately end the risks for websites and systems using the programming language, cybersecurity experts warn. Older versions may no longer receive official fixes, and attackers could still exploit systems that have not been updated or regain access through a backdoor left by an earlier intrusion, they say. [1]

Ethical hacker Wouter van Dongen says applying a patch closes the vulnerability but does not undo a previous breach. Gert Heiremans, head of technology and security at Belgian identity app itsme, warns that stolen data may take time to come to light. [1]

Richard Verbeek of IT services firm Fellowmind says organisations should check whether attackers had already gained access before putting a website back online. Installing an update does not by itself establish that the site and its underlying systems are secure, he says. [1]

The experts expect many systems worldwide will not be updated straight away, leaving some exposed for months. They say the expected wave of PHP patch downloads is not likely to overload systems. [1]