'We expect mass attacks to start within 15 minutes of the release': Web admins braced for emergency PHP updates to plug leaked high-severity holes

The PHP security team has given advanced notice of an upcoming fix for two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale.

Info about the flaws seems to have leaked ahead of their official disclosure, as a video is being shared which reportedly shows a tool called PHP2Shell being used to remotely execute code on webservers via the vulnerabilities (via Ars Technica).

The PHP programming language is widely used across the internet and powers a huge number of websites. The fix is due to be released at 2pm UTC (10 am ET). Researchers from cybersecurity firm Sansec say the vulnerabilities affect all web servers running PHP 5.4 or later, and that "we expect mass attacks to start within 15 minutes of the release."

Dane Knecht, the chief technology officer for Cloudflare, says the company is already updating its firewall rules for PHP sites. …