Cyber agencies warn PHP users to install critical update or take sites offline

Cyber-security agencies in the UK, EU and Australia have urged organisations that use PHP to install a critical update as soon as it becomes available. The PHP Foundation is issuing updates on Wednesday afternoon to address two critical vulnerabilities in the widely used programming language.

The Netherlands’ cyber-security agency said it is taking its own website offline because of the vulnerabilities. The UK’s National Cyber Security Centre (NCSC) advised organisations to consider taking affected systems offline if they cannot fix them immediately. EU cyber-security officials issued a similar warning.

The European Union Agency for Cybersecurity’s incident response team, CERT-EU, said the vulnerabilities’ risk scores indicate the potential for unauthenticated remote code execution. Such an attack could let hackers install malware or take websites offline. Cloudflare chief technology officer Dane Knecht said the company was seeing early attacks and updating its mitigations as new vectors appeared.

PHP is used across many websites and services, including WordPress, Drupal, Joomla and Magento, according to cybersecurity company Huntress. CERT-EU said the vulnerabilities could affect all PHP versions dating back to PHP 5, released in 2004. The affected versions have not yet been confirmed.

The NCSC also urged organisations to keep monitoring security updates from third-party software vendors, including providers of appliances and services that bundle PHP.