PHP security patches prompt EU warning over website shutdown risk

Traders Union
All News
Business & Wealth
Companies
PHP security patches EU warning

Highlights

PHP will release patches for two critical vulnerabilities rated 9.2 CVSS at 1400 GMT Wednesday, urging immediate user upgrades.
CERT-EU warns of unauthenticated remote code execution risk, advises organizations to prepare for urgent patching or consider site shutdowns.
Vulnerabilities could affect all PHP versions from PHP 5 onward, exposing millions of WordPress, Drupal, Joomla, Magento, and hosting environments to potential attack.

Patch release timetable and official warnings

As reported by BusinessWorld Online, citing PHP, patches for the two vulnerabilities are scheduled for release at 1400 GMT on Wednesday, with the project's security team urging users to upgrade as soon as the update becomes available. In its security update, PHP rates both flaws at 9.2 on the CVSS v4.0 severity scale and says full details on the vulnerabilities, affected versions and fixed releases will be published when the patches are issued.

The European Union Computer Emergency Response Team, CERT-EU, says in an advisory issued on Tuesday that the score indicates a risk of unauthenticated remote code execution, which can let attackers run malicious code on vulnerable systems without logging in. CERT-EU urges organizations to prepare for immediate patching of affected assets and says those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Center issues similar guidance, telling organizations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity. The agency says it is not currently aware of active exploitation related to the vulnerabilities.

Broad exposure across hosting and web services

PHP is used across large parts of the internet, raising the potential for disruption across websites and hosting environments if the vulnerabilities affect a wide range of versions. CERT-EU and the ACSC say all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.

Cybersecurity company Huntress says PHP quietly powers WordPress, Drupal, Joomla and Magento sites, as well as shared hosting platforms, control panels and other software that does not clearly advertise its use of the language. Web hosting provider GoDaddy says the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

Cohere’s planned acquisition of AI cybersecurity startup AISLE highlighted how AI is being used to uncover software vulnerabilities at scale. Our earlier article noted that AISLE’s tooling had already identified hundreds of new bugs in widely used software, including multiple OpenSSL vulnerabilities that were subsequently fixed—underscoring the growing role of proactive vulnerability research in reducing real-world exposure.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.