Europe’s cyber emergency team has told websites that cannot patch two critical PHP vulnerabilities to consider going offline. Both flaws could let attackers take over web servers without a login.
PHP sits underneath a large share of the web, from WordPress blogs to Magento online stores. However, details of both flaws leaked online before the fixes were ready.
Attackers Got a Head Start
The leak surfaced on October 20, ahead of the planned disclosure, Huntress reported. The PHP Foundation’s security team then scheduled its release for October 21 at 14:00 UTC.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
— The PHP Foundation (@ThePHPF) October 20, 2026
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Security firm watchTowr has since reproduced one of the two bugs, according to Huntress. Huntress itself said it had not seen exploitation across its customers’ systems.
In contrast, Cloudflare chief technology officer Dane Knecht said attacks have already started. His company has deployed firewall rules against the known attack paths for all customers, including free users.
We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only.
Knecht shared the warning in a post on X.
The European Union Computer Emergency Response Team (CERT-EU) and Australia’s cyber agency both warned that the PHP vulnerabilities could affect every release from PHP 5 onward, Reuters reported.
Some researchers expect fixes only for supported PHP 8 versions, Huntress noted. That could leave sites on older, unsupported releases without a patch.
The alert arrives weeks after more than 100 companies warned of AI cyberattacks surging within months.
What PHP Vulnerabilities Mean for Website Owners
PHP runs on about 69% of websites whose server-side language is known, W3Techs data shows. WordPress alone powers roughly 40% of all websites.
CERT-EU said the 9.2 severity score signals unauthenticated remote code execution. In plain terms, an outsider could run malicious code on a server without any credentials.
Web host GoDaddy warned that attackers could steal data, deface websites, or take full control of a system. Stolen records have real value, as the South Korean bank breaches showed.
Security plugin Wordfence noted that every WordPress site sits on a PHP server. Yet WordPress automatic updates will not fix the PHP vulnerabilities. Site owners therefore need to find out who manages PHP for them.
Attacks on everyday infrastructure keep spreading, as the French supermarket fridge hack showed in October. These PHP vulnerabilities shift that pressure to the software layer under much of the web, where one skipped server update can open the door.
The post Why the EU Is Telling Some Websites to Switch Themselves Off appeared first on BeInCrypto.