Security agencies urge urgent PHP patching as two critical flaws come to light

Government cyber-security bodies have told organisations that run websites on PHP to install a newly released security update without delay, or to think about taking their sites offline, according to BBC News. The warning follows the discovery of two critical vulnerabilities in the programming language, which runs on servers behind a large share of the web.

Fixes released, attacks already reported

The PHP Foundation, the organisation that supports the language, was due to publish updates addressing both flaws on Wednesday afternoon. The UK's National Cyber Security Centre (NCSC), together with its counterparts in the EU and Australia, has advised users to apply the patches as soon as they are available. Where that cannot happen straight away, the NCSC said organisations should consider disconnecting affected systems until the risk is dealt with.

The Netherlands' national cyber-security agency has gone further, taking its own website offline because of the issues.

The European Union Computer Emergency Response Team (CERT-EU) said the severity ratings assigned to the flaws point to a risk of what it called "unauthenticated remote code execution". In practice, that kind of weakness could let attackers run their own code on a server without logging in, potentially installing malware or knocking sites offline. The chief technology officer of internet infrastructure firm Cloudflare said early attacks were already being seen and that protections were being adjusted as new methods appeared.

Unclear scope

It has not yet been confirmed exactly which versions of PHP are vulnerable. CERT-EU said every release from PHP 5 onwards, a version first launched in 2004, could be affected. Security firm Huntress noted that PHP underpins popular content management and e-commerce platforms, shared hosting services and control panels, as well as software that does not openly state it relies on the language.

Beyond the immediate patch, the NCSC advised organisations to keep watching for updates from third-party vendors, including makers of appliances and services that bundle PHP within their products.

What it means for website owners

For anyone running a website, blog or online shop, the episode is a reminder that the software beneath a site matters as much as its content. Owners who manage their own servers should check which PHP version they use and update promptly, while those on hosted platforms may want to confirm with their provider that fixes have been applied. Keeping plugins, themes and bundled tools current, and having a plan for taking a site offline temporarily, can reduce exposure when serious flaws emerge.