PHP Is Patching Two 9.2-Severity Flaws — and the EU Says Unpatched Sites Should Go Offline

October 21 — According to Reuters, the PHP development team has announced that it will release patches for two serious security vulnerabilities. EU cybersecurity officials have warned that organisations unable to install the patches should take the affected websites offline.

PHP is used by a huge number of websites across the internet. Over the past day, speculation has been circulating that sites using PHP could face serious cyber intrusions.

The security firm Huntress wrote in a blog post: “PHP is everywhere. From WordPress, Drupal, Joomla and Magento sites to shared hosting platforms, admin panels, and plenty of software that never mentions PHP at all, PHP is quietly running underneath.”

In its security advisory, the PHP development team said that, under version 4.0 of the Common Vulnerability Scoring System (CVSS), both vulnerabilities reach a severity of 9.2, and it urged users to upgrade as soon as fixed versions are released.

On the 20th local time, the EU’s Computer Emergency Response Team (CERT-EU) issued a security notice saying that a score of 9.2 indicates that both vulnerabilities carry a risk of remote code execution without authentication. Attackers could use such flaws to run malicious code remotely without logging in.

CERT-EU urged organisations to be ready to fix affected systems as soon as patches are released, and said that those unable to fix them in time should consider taking the affected websites offline temporarily.

Australia’s Cyber Security Centre (ACSC) issued similar advice, urging organisations to identify systems using PHP, prepare to install patches and monitor applications for signs of malicious activity. The centre has not yet seen anyone actually exploiting the vulnerabilities in attacks.

Web hosting provider GoDaddy warned that attackers could use the flaws to execute code on affected servers over the internet, leading to stolen data, defaced website content or even full compromise of the system.

The PHP security team said that, when the patches are released, it will publish details of the vulnerabilities, the affected versions and the fixed versions.

CERT-EU and ACSC noted that all versions of PHP from PHP 5 onward may be affected, but the PHP development team has not yet said which specific versions are vulnerable.