Some websites may go down as huge internet vulnerabilities found, cyber agency warns

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

Developers behind the widely used PHP programming language on Wednesday announced they would issue patches for two critical vulnerabilities, prompting warnings from EU cybersecurity officials that organisations unable to apply the updates should take affected websites offline.

Because PHP underpins expansive sections of the internet, concerns have grown over the past day that sites using the software remain vulnerable to severe cyber intrusions.

In a blog post, cybersecurity firm Huntress said: "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."

PHP confirmed in a security advisory that both security flaws were rated 9.2 on the CVSS v4.0 severity scale, urging users to "upgrade as soon as the release is available".

A fix addressing both issues was scheduled to go live at 2pm GMT (3pm BST) on Wednesday.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare , said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X.

The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.

CERT-EU urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.

"ACSC is currently not aware of active exploitation related to these vulnerabilities," the agency said.

Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.

PHP's security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.

CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies