EU Cyber Agency Urges Organisations to Take Unpatched Websites Offline as PHP Readies Fixes for Critical Flaws

Brussels: The European Union’s cybersecurity response body has advised organisations to consider taking their websites offline if they cannot quickly apply upcoming security fixes for PHP, the programming language that underpins a large share of the world’s websites. The warning came as PHP’s developers confirmed they would release patches for two critical vulnerabilities on Wednesday, October 21.

According to PHP’s security team, both flaws carry a severity score of 9.2 on the CVSS v4.0 scale, and users have been urged to upgrade as soon as the new releases become available. The team said full details of the vulnerabilities, the affected versions and the corrected releases would be made public alongside the patches, which were scheduled for 14:00 UTC.

In an advisory issued on Tuesday evening, the Computer Emergency Response Team for the EU institutions, bodies and agencies (CERT-EU) said the severity rating points to a risk of unauthenticated remote code execution. Such a flaw could allow attackers to run malicious code on a vulnerable server over the internet without needing login credentials. CERT-EU called on organisations to identify all PHP applications in their environments and to prepare for immediate, simultaneous patching, adding that those unable to do so should consider isolating or taking affected sites offline until fixes are in place.

The Australian Cyber Security Centre (ACSC) issued parallel guidance, advising organisations to locate PHP systems, prepare to deploy the patches and monitor applications for signs of malicious activity. Both CERT-EU and the ACSC indicated that every PHP version from PHP 5 onward could be affected, although PHP itself has not yet confirmed which versions are vulnerable. The ACSC noted that it was not aware of any active exploitation of the flaws so far.

The scale of potential exposure is significant. PHP runs behind widely used content management and e-commerce platforms such as WordPress, Drupal, Joomla and Magento, as well as shared hosting services, control panels and many applications that do not openly indicate their reliance on the language.

Web hosting company GoDaddy cautioned that the vulnerabilities could enable attackers to steal data, deface websites or gain full control of servers. Wordfence, a security plugin provider for WordPress, pointed out that because every WordPress site runs on a server with PHP installed, routine automatic updates to WordPress will not deliver the fix. It advised site owners to establish who is responsible for updating PHP on their servers, whether an in-house team or a hosting provider.

Cybersecurity experts have urged administrators to treat the update as a priority and to apply the patches without delay once they are published.