The developers of the PHP programming language, which is extensively used across the internet, said on Wednesday they would fix two critical vulnerabilities.
Concerns have escalated in recent days that websites running the software would be exposed to serious cyber intrusions.
PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”. It added a patch for both vulnerabilities was scheduled for 2pm GMT on Wednesday.
The Wikimedia Foundation, which runs online encyclopedia Wikipedia, was one company on Wednesday which said it was in the process of addressing security vulnerabilities in the PHP programming language.
Read more:
Speaker scolds government for treating media as ‘more important’ than MPs
Australian MP has both legs amputated, husband confirms
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of the risks. French government websites were taken offline temporarily as it waited for the PHP fix. Users visiting the websites were told there was “ongoing maintenance”.
Also, government agencies in the Netherlands and Finland were among those which took sites offline as a precaution.
The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.
It urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking their sites offline.
Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet which could potentially lead to data theft, website defacement or full system compromise.
The Australian Cyber Security Centre (ACSC) issued similar guidance by urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.
Cybersecurity agencies in Britain and Japan are also among those urging PHP users to update immediately or take websites offline until patches can be applied.
Cybersecurity company Huntress said in a blog post: “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.”
Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.
He said on X: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.
“This is a STOPGAP only. Patch as soon as PHP releases the update.”
PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.
Don Smith, VP Threat Intelligence, Sophos Counter Threat Unit, said: “The immediate challenge is not simply installing a patch, but finding and managing every instance where PHP is running. The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.
“Security teams should prioritise internet-facing systems, confirming which versions are affected as soon as the official advisory is published, and apply the updates without delay. And in line with the advice from NCSC, any vulnerable system that cannot be patched should be isolated from the internet until it can be secured.
“Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organisations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold.”
