October 21 (Albania Journal) – Developers of the widely used PHP programming language said on Wednesday that they would release security patches for two critical vulnerabilities, prompting European Union cybersecurity officials to warn organisations to temporarily take affected websites offline if they cannot apply the fixes.
PHP powers a significant portion of the internet, including many content management systems, web hosting platforms and online applications. Concerns have grown over the past day that websites running the software could be vulnerable to serious cyberattacks.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.
In a security advisory, PHP rated both vulnerabilities 9.2 on the Common Vulnerability Scoring System (CVSS) version 4.0 scale, indicating a critical level of concern. The development team urged users to “upgrade as soon as the release is available”.
Patches for both vulnerabilities were scheduled for release at 1400 GMT on Wednesday.
Dane Knecht, chief technology officer at web and cloud security firm Cloudflare, said early attacks were already emerging. The company was updating its firewall rules to provide temporary protection while users awaited the official fixes.
“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.
The European Union Computer Emergency Response Team (CERT-EU) issued an advisory on Tuesday, warning that the vulnerabilities could allow unauthenticated remote code execution. Such flaws can enable attackers to run malicious code on vulnerable systems without logging in.
CERT-EU urged organisations to prepare to patch affected systems immediately. It also advised those unable to apply the fixes to consider taking vulnerable websites offline until they could be secured.
The Australian Cyber Security Centre (ACSC) issued similar guidance, asking organisations to identify PHP-based systems, prepare to install the patches and monitor applications for signs of malicious activity.
“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.
Web hosting provider GoDaddy warned that the flaws could allow attackers to execute code remotely on affected servers, potentially resulting in data theft, website defacement or a complete compromise of the affected systems.
Wordfence, a security plugin used to protect WordPress websites, noted that all WordPress sites run on servers with PHP installed. It warned that automatic WordPress updates would not resolve the vulnerabilities and advised website owners to identify who manages PHP updates on their hosting platforms.
PHP’s security team said further details about the vulnerabilities, the affected software versions and the patched releases would be published when the updates became available.
CERT-EU and the ACSC said all PHP versions from PHP 5 onward could potentially be affected, although PHP had not yet disclosed the specific versions vulnerable to the flaws.
