Overview
- Security teams and CERT-EU disclosed two critical PHP vulnerabilities and the PHP project scheduled a security patch for 16:00 Dutch time on Wednesday, prompting immediate warnings to prepare for rapid updates.
- Public bodies, hospitals, universities, media groups and many municipal websites were taken offline as a precaution while administrators wait for the fix or apply isolating measures.
- Cloudflare reported seeing early attack attempts that target the flaws, while the Dutch NCSC and other national agencies say they have not yet confirmed large-scale misuse but continue to urge immediate patching of public-facing PHP systems.
- The bugs allow remote code execution that can let attackers take control of servers and affect sites that run PHP directly or through platforms such as WordPress, Drupal and shared hosting control panels, a risk amplified because roughly 70% of websites use PHP or its derivatives.
- Once the patch is released organisations should install it without delay and expect follow-on activity such as automated scans, rapid exploit attempts and potential data theft or extortion that could prolong service disruptions.