PHP flaws trigger outage fears & retail fraud warnings

Security experts have warned that critical PHP vulnerabilities could expose websites to server compromise and follow-on fraud. The flaws have prompted some organisations to take websites offline.

The issue centres on two vulnerabilities that researchers said could allow attackers to execute code remotely on vulnerable PHP servers. Because PHP is widely used across the web, businesses that rely on it for customer-facing services could face broad exposure.

Akamai researchers said the vulnerabilities affect PHP's built-in file-upload functionality and could expose endpoints that accept uploads, even when an application does not actively process the files. They added that the flaws highlight how difficult it has become for security teams to identify exposed systems and apply patches quickly enough.

If systems are compromised, businesses face immediate operational risks, including website outages, theft of data and credentials, and the possibility of attackers moving from one server into wider corporate environments.

"From a business-risk standpoint, this is an emergency patching event: successful exploitation can lead to full server compromise, data theft, credential/token exposure from process memory, and lateral movement into broader environments. CXOs and security leaders should prioritise hiding attack surfaces wherever possible. What can't be discovered is harder to exploit using AI. They should also apply Zero Trust principles everywhere, including inside the office, and not just for remote access. Finally, they should minimize the blast radius with segmentation and deception, and modernise SecOps for machine-speed defense by performing red teaming on all external assets," said Deepen Desai, Chief Security Officer, Zscaler.

Retail impact

For retailers, the concern extends beyond the initial disruption. If attackers gained access to customer data or account credentials during the window of exposure, the effects could continue long after websites are restored.

The risk is especially acute ahead of peak shopping periods, when higher transaction volumes can make fraudulent activity harder to detect. Criminals who gain access to genuine customer accounts can misuse stored payment details, loyalty points, or store credit. They may also change delivery details and redirect orders.

"Retailers websites will not be immune from PHP vulnerabilities. The immediate concern is whether retailers can keep their websites operating safely. However, they should also be factoring the possible longer term impacts that could continue even after services are restored. If attackers have been able to access customer information or login credentials, that data can be used for convincing phishing attempts and account takeovers in the weeks and months ahead. This is particularly concerning ahead of Peak shopping season as high transaction volumes can give fraudulent activity more cover. Criminals who gain access to legitimate customer accounts may attempt to exploit saved payment details, loyalty points or store credit while changing delivery information to redirect an order. Retailers should therefore watch for chains of unusual behaviour - for instance, logins from a new device followed by a password reset, an address change or sudden high value purchases. The challenge is to identify those patterns without introducing blanket checks that delay or decline genuine customers during the busiest trading period of the year. Restoring a website may resolve the immediate disruption but understanding whether any data was compromised, and how it could subsequently be used, will be just as important in the aftermath," said Xavier Sheikrojan, Director of Risk, Signifyd.

AI pressure

The commentary also points to a wider shift in cyber risk. Security researchers and vendors have increasingly linked AI tools to faster vulnerability discovery and quicker weaponisation of newly disclosed flaws. That adds pressure on defenders, particularly smaller organisations with fewer resources and less mature patching processes.

Akamai said the PHP flaws could put millions of websites at risk. Its researchers described the vulnerabilities as a sign of growing strain on security teams as the volume of critical threats rises.

For companies assessing their exposure, the response is likely to unfold in two phases: emergency containment and patching, followed by a forensic review to determine whether attackers accessed data, credentials, or internal systems before mitigations were applied.

That second phase may prove as important as restoring normal service, especially for retailers and other consumer-facing businesses that must manage fraud risks after the technical outage has passed.