Critical PHP vulnerabilities prompt warning to take sites offline

Summarised from 2 outlets · Updated 21 Oct, 12:08 · Archive

Two critical vulnerabilities in the PHP programming language have prompted cybersecurity warnings.

Two critical vulnerabilities in PHP, the programming language used to power a large portion of the internet, have triggered major cybersecurity warnings. PHP is used to run WordPress, Drupal, Joomla, Magento and other widely deployed software across shared hosting platforms and control panels.

PHP rated both vulnerabilities 9.2 out of 10 on the CVSS v4.0 severity scale, with 10 being the highest. The European Union Computer Emergency Response Team warned that the flaws carry a risk of unauthenticated remote code execution, allowing attackers to run malicious code on vulnerable systems without logging in. The Australian Cyber Security Centre issued similar guidance, urging organisations to identify PHP systems in their environments and prepare to apply patches immediately. Both agencies said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which specific versions are vulnerable.

PHP scheduled release of patches for both vulnerabilities for 2pm GMT on Wednesday. The Australian Cyber Security Centre said it was not currently aware of active exploitation related to these vulnerabilities. Organisations unable to apply fixes promptly have been advised to consider taking affected websites offline.

Critical PHP vulnerabilities prompt warning to take sites offline — Image: Perth Now

Comments (0)

How it is being reported

Warning websites may go dark as critical fix preparedMajor cybersecurity warnings have been issued after serious vulnerabilities were identified in widely used software, with Cloudflare reporting early attacks.Perth Now · 21 Oct, 11:40
Warning websites may go dark as critical fix preparedMajor cybersecurity warnings have been issued after serious vulnerabilities were identified in widely used software, with Cloudflare reporting early attacks.The West Australian · 21 Oct, 11:40

In this story: PHP · Cloudflare · European Union Computer Emergency Response Team · Australian Cyber Security Centre · Huntress

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem