Overview
- Developers disclosed two remote‑code‑execution vulnerabilities and released security patches at about 16:00 on Wednesday, after CERT‑EU and the NCSC urged immediate mitigation.
- Hundreds of municipal, provincial, hospital and other public websites were taken offline as a precaution to prevent attackers from using the PHP flaws to run code or install backdoors.
- NotuBiz and other suppliers proactively put shared council systems into maintenance and report no confirmed intrusions so far, while the NCSC says it has not seen active exploitation.
- Cybersecurity experts warn that a patch stops new attacks but does not remove any existing backdoors, and that older, unsupported PHP versions will leave many systems vulnerable for months.
- The PHP Foundation acknowledged a delayed and under‑resourced response, prompting scrutiny of open‑source governance and calls for wide audits and longer‑term investment in secure maintenance.