EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

PHP developers announced patches for two critical vulnerabilities in the widely used programming language. The flaws received a 9.2 rating under CVSS v4.0. PHP said users should upgrade as soon as the fixed release became available. The patches were scheduled for 1400 GMT on Wednesday.

The urgency comes from the possibility of unauthenticated remote code execution. This can allow an attacker to run malicious code on an affected system without first logging in. Because PHP supports many websites, hosting platforms, control panels, and applications, one weakness could expose important internet-facing systems.

CERT-EU told organisations to prepare for immediate patching. It said those unable to apply the fixes should consider taking affected websites offline. The ACSC gave similar advice, although it said it was not aware of active exploitation. PHP planned to publish affected versions and fixed releases with the patches.

PHP is a programming language used across large parts of the internet. It helps run websites and web applications, often without visitors knowing which technology is working behind the scenes. The article describes it as quietly powering major publishing, commerce, and website-management platforms.

For example, PHP supports WordPress, Drupal, Joomla, and Magento sites. It also operates on shared hosting platforms and control panels. This means PHP can be part of the website itself, the hosting environment, or software used to manage online services. A weakness in the language can therefore affect more than one visible website.

Its broad presence explains the security response. PHP developers urged users to upgrade when the fixes became available. Organisations were also told to identify PHP systems in their environments and prepare patches. The article does not provide a precise percentage of websites using PHP, but says it is used across large parts of the internet.

PHP’s reach is broad enough that a security issue can affect many kinds of online services. The article says PHP is used across large parts of the internet. It also notes that some software does not openly advertise that it runs PHP, making the technology harder for organisations to spot.

The named examples include WordPress, Drupal, Joomla, and Magento. PHP also supports shared hosting platforms and control panels. These examples cover content publishing, website management, online commerce, and hosting operations. A single organisation may use PHP in several places without realising every affected asset.

The article does not state how many websites or servers use PHP. It does make the scale clear through the range of platforms and services involved. That widespread use is why CERT-EU and the ACSC urged organisations to identify PHP systems, prepare patches, and monitor applications for suspicious activity.

CVSS is a system for describing the severity of security vulnerabilities. The article reports that both PHP flaws scored 9.2 under CVSS v4.0. That is a very high rating, meaning organisations should treat the weaknesses as urgent rather than routine software bugs.

CERT-EU linked the rating to a specific danger: unauthenticated remote code execution. In practical terms, an attacker may be able to send a malicious request over the internet and make a vulnerable system run code. The attacker would not need to log in first. This makes exposed websites especially important to secure quickly.

The score does not prove that every PHP installation can be attacked or that exploitation is happening. PHP had not yet disclosed the affected versions when the advisory was issued. The ACSC also said it was not aware of active exploitation, but still urged organisations to identify systems, prepare patches, and monitor applications.

Unauthenticated remote code execution is a security flaw that lets an attacker make a computer run code from a remote location without proving their identity. “Unauthenticated” means no login is required. “Remote” means the attacker can reach the target over a network, potentially through the internet.

The key mechanism is malicious input sent to a vulnerable PHP system. If the system handles that input incorrectly, it may execute the attacker’s instructions instead of treating them as ordinary data. The article identifies this as the risk represented by the two PHP vulnerabilities, although it does not describe their technical root cause.

This matters because internet-facing websites can receive requests from unknown users. GoDaddy said the flaws could allow code execution on affected servers. Possible outcomes included data theft, website defacement, or full system compromise. The article does not report confirmed exploitation, but agencies urged quick patching and monitoring.

A vulnerable PHP website or server could be forced to execute an attacker’s code. That would give the attacker an opportunity to interfere with the website or the system supporting it. The seriousness depends on the affected environment, but the article describes the possible consequences as substantial.

GoDaddy said attackers could execute code on affected servers over the internet. It listed data theft, website defacement, and full system compromise as possible results. Data theft could expose information, while defacement could replace or alter what visitors see. Full compromise represents the broadest danger to the server and its contents.

These are potential consequences, not confirmed events reported in the article. The ACSC said it was not aware of active exploitation related to the vulnerabilities. Still, CERT-EU urged immediate patching and recommended that organisations unable to patch consider taking affected sites offline until protection was available.

Leaving an unpatched website online can give attackers continued access to a known weakness. Taking it offline interrupts that exposure while the organisation identifies the system, obtains the PHP fix, and applies it. This is a defensive measure, not a permanent solution, because visitors and services may be unavailable.

The reason for the recommendation is the reported risk of unauthenticated remote code execution. An attacker may be able to send requests from the internet and run malicious code without logging in. If the site is offline, those public requests cannot reach it through its normal online service. The article does not describe other protective measures in detail.

CERT-EU said organisations unable to apply the fixes should consider taking affected sites offline. The ACSC similarly urged organisations to identify PHP systems, prepare patches, and monitor applications. PHP scheduled patches for Wednesday and told users to upgrade as soon as the release became available.