EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

CERT-EU rated the flaws 9.2 and warned unauthenticated remote code execution could let attackers compromise vulnerable systems.

On Wednesday, Oct 21, 2026, PHP developers announced they will release patches for two critical vulnerabilities, scheduling the fix for 1400 GMT amid speculation of serious cyber intrusions.

Both vulnerabilities hold a 9.2 rating on the CVSS v4.0 severity scale, indicating a risk of unauthenticated remote code execution, with all versions from PHP 5 onward potentially affected.

Cybersecurity company Huntress noted the software powers WordPress, Drupal, Joomla, and Magento sites, while web hosting provider GoDaddy warned attackers could execute code and compromise systems entirely.

The European Union Computer Emergency Response Team urged organizations to prepare for immediate patching, advising administrators unable to apply fixes should consider taking affected sites offline.

While the Australian Cyber Security Centre stated it is currently not aware of active exploitation, PHP urged users to "upgrade as soon as the release is available.

EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities - BusinessWorld Online

THE DEVELOPERS of the widely used PHP programming language said on Wednesday they would release patches for two…

Critical PHP flaws put millions of websites at risk

Two critical PHP vulnerabilities threaten website security, prompting urgent warnings from EU and Australian cybersecurity authorities as developers prepare fixes.

EU cybersecurity agency in warning on PHP vulnerabilities

EU cybersecurity officials have warned organisations unable to apply planned PHP fixes should take affected websites offline.

EU warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions

EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes ​should take affected websites offline.

Vulnerabilities in the Widely Used PHP Programming Language

The EU agency has called for websites to be taken down if corrective updates cannot be made.

78 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage