Websites Urged to Apply Critical PHP Update or Consider Going Offline

Organisations relying on the PHP programming language have been advised to install a critical software update immediately or consider taking their websites offline. Two significant vulnerabilities have been identified in PHP, a language that powers a substantial portion of the internet.

The PHP Foundation is releasing updates to address these issues. The UK's National Cyber Security Centre (NCSC), alongside its counterparts in the European Union and Australia, has urged users to apply the fixes as soon as they become available. The Netherlands' cyber-security agency has announced it is taking its own website offline due to the vulnerabilities.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC stated. EU cyber-security officials have issued a similar warning.

PHP is known to underpin popular content management systems like WordPress, Drupal, and Joomla, as well as shared hosting platforms and numerous other software applications that may not overtly advertise their use of the language. The European Union Computer Emergency Response Team (CERT-EU) has indicated that the vulnerabilities carry risk scores suggesting the potential for unauthenticated remote code execution. Such an attack could enable hackers to install malware and disrupt website operations.

Dane Knecht, chief technology officer at Cloudflare, reported observing early attacks and updating mitigations as new vectors emerge. Once the update is installed, organisations are advised to continuously monitor for security updates from third-party software vendors, including those for bundled PHP services.

While it is not yet clear which specific versions of PHP are affected, CERT-EU suggests that all versions dating back to PHP 5, released in 2004, could be vulnerable. PHP, created for web development, operates on servers to generate the content users see on websites.