Organisations that rely on the PHP programming language are being urged to install a significant software update today or consider taking their websites offline. Two critical vulnerabilities have been identified in PHP, which is widely used across the internet. The PHP Foundation, which supports the language, is issuing updates to address these vulnerabilities on Wednesday afternoon.
Urgent Warnings from Cyber Security Agencies
The UK's National Cyber Security Centre (NCSC), along with its counterparts in the EU and Australia, has urged PHP users to apply the fixes as soon as they become available. The Netherlands' cyber-security agency has announced that it is taking its own website offline due to the identified vulnerabilities.
“"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC stated in a note.
EU cyber-security officials have issued a similar warning. According to cybersecurity company Huntress, "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
