Cybersecurity agencies in the UK, EU and Australia have warned organisations to install critical PHP security fixes immediately or consider taking vulnerable websites offline amid reports of emerging attacks, reports Asianlite News Desk.
Cybersecurity authorities have urged organisations worldwide to install urgent security updates for the PHP programming language after two critical vulnerabilities were identified, warning that websites may need to be taken offline if the risks cannot be addressed immediately.
The PHP Foundation, which supports the development of the widely used programming language, is issuing fixes for the vulnerabilities on Wednesday afternoon. The UK’s National Cyber Security Centre (NCSC), along with cybersecurity agencies in the European Union and Australia, has advised organisations to apply the updates as soon as they become available.
The NCSC warned that organisations unable to implement immediate fixes should consider taking affected systems offline until the vulnerabilities can be fully addressed.
The warnings have already prompted precautionary action in the Netherlands, where the country’s cybersecurity agency has taken its own website offline. The Dutch government’s National Institute for Public Health and the Environment has also removed its website from public access, while the website of the Tweede Kamer, the lower house of parliament, has become inaccessible.
The European Union Agency for Cybersecurity’s incident-response network, CERT-EU, said the vulnerabilities’ risk ratings indicated the potential for unauthenticated remote code execution. This type of attack could allow hackers to run malicious code on vulnerable systems without first obtaining legitimate access, potentially enabling them to install malware or disrupt websites.
Dane Knecht, chief technology officer at internet infrastructure company Cloudflare, said the company was seeing early attacks emerging and was updating its protective measures as new attack methods appeared.
PHP is widely used to build and operate websites and powers platforms including WordPress, Drupal, Joomla and Magento. It also runs behind many hosting services, website control panels and other software products, sometimes without users being aware of its presence.
Cybersecurity firm Huntress highlighted the programming language’s extensive reach across the internet, raising concerns that the vulnerabilities could expose a large number of organisations to potential attacks.
The full range of affected PHP versions has not yet been established. CERT-EU warned that the issue could potentially affect versions dating back to PHP 5, which was introduced in 2004.
The NCSC has also advised organisations to continue monitoring security updates from third-party software vendors, including providers of appliances and services that incorporate PHP, the BBC reported.
PHP is a server-side programming language used to generate and manage website content. Although not every website relies on it, its widespread adoption means that security flaws can have consequences across multiple sectors.
Authorities are urging organisations to prioritise patching and limit exposure until vulnerable systems are secured.
