Websites across the internet face a potential security risk as developers of PHP prepare emergency patches for two critical vulnerabilities that could expose servers to cyberattacks.
PHP, a widely used server-side programming language, powers major website platforms and content management systems, including WordPress, Drupal, Joomla and Magento.
The vulnerabilities have each received a severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system. They could allow attackers to execute malicious code on vulnerable servers without first logging in, potentially leading to data theft, website defacement or complete system compromise.
The European Union’s cybersecurity response team, CERT-EU, has advised organisations to prepare for immediate security updates. It also recommends isolating affected internet-facing systems if patches cannot be applied promptly.
Australia’s Cyber Security Centre has issued similar guidance, urging administrators to identify systems running PHP, monitor for suspicious activity and install the fixes as soon as they become available.
Website owners should note that the vulnerability may affect older PHP versions, with cybersecurity advisories warning that versions dating back to PHP 5 could be exposed. The precise scope will depend on the affected versions and the official security release.
Administrators are being urged to prepare their systems for immediate updates and check with their hosting providers if they do not manage server software themselves.
The situation highlights the importance of timely security updates, particularly for websites that handle sensitive information or support business operations.
Website owners and developers are encouraged to monitor official PHP security announcements and prioritise remediation once the patches are released.
Leave a comment