The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities imminently, as EU cybersecurity officials warned that organisations unable to apply the fixes should take affected websites offline.
PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.
In a security update, PHP said both vulnerabilities were rated 9.2 out of 10 on version 4.0 of the Common Vulnerability Scoring System (CVSS), and urged users to “upgrade as soon as the release is available”. A patch for both was scheduled for 4pm South African time (2pm GMT) on Wednesday. PHP’s security team said details of the vulnerabilities, the affected versions and the fixed releases would be published when the patches are issued.
The EU Computer Emergency Response Team (Cert-EU) said in an advisory on Tuesday that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.
Cert-EU urged organisations to prepare to patch affected systems immediately and said those unable to do so should consider taking affected sites offline.
Early attacks
The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity. “ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.
Cert-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.
Cloudflare says attacks have already started. Dane Knecht, CTO of the web and cloud security firm, said on X that the company was updating its firewall rules as a stopgap.
“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only. Patch as soon as PHP releases the update,” he said.
Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.
Wordfence, a security plugin for WordPress websites, said every WordPress site runs on a server with PHP installed. It warned that WordPress’s automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites. — Rajveer Singh Pardesi, Devika Nair, Shubham Kalia and Raphael Satter, (c) 2026 Reuters
