Cybersecurity agencies have warned organisations to prepare for emergency security updates after developers of the widely used PHP programming language announced patches for two critical vulnerabilities that could expose websites to cyberattacks.
The vulnerabilities have been rated 9.2 out of 10 on the CVSS v4.0 severity scale, with European cybersecurity officials warning that organisations unable to apply the fixes should consider taking affected websites offline.
PHP powers a substantial portion of the internet, including websites built on WordPress, Drupal, Joomla and Magento. The vulnerabilities could put websites, hosting platforms and other systems running the software at risk.
Critical Vulnerabilities Could Allow Remote Attacks
PHP developers announced on Wednesday, October 21, that security patches for both vulnerabilities were scheduled for release at 1400 GMT.
In its security advisory, the PHP team urged users to upgrade as soon as the fixes became available.
The European Union’s Computer Emergency Response Team (CERT-EU) warned that the severity rating indicated a risk of unauthenticated remote code execution. This type of vulnerability can allow attackers to run malicious code on affected systems without first logging in.
CERT-EU advised organisations to prepare for immediate patching and consider taking vulnerable websites offline if they could not apply the updates.
Cybersecurity company Huntress highlighted the scale of the potential exposure, noting that PHP runs behind a wide range of websites and services, including shared hosting platforms, control panels and software that may not openly advertise its reliance on the language.
Cloudflare Reports Early Signs of Attacks
Cloudflare Chief Technology Officer Dane Knecht said early attacks exploiting the vulnerabilities were beginning to emerge.
The web infrastructure and security company said it was updating its firewall rules to provide temporary protection while new attack methods appeared.
Knecht warned that these measures were only a stopgap and urged organisations to install the official PHP patches as soon as they became available.
The warning highlights the urgency of the situation, with organisations potentially exposed while developers and security providers work to address the flaws.
Australian Cybersecurity Agency Issues Warning
The Australian Cyber Security Centre (ACSC) has also issued guidance, urging organisations to identify PHP systems across their networks, prepare to install the security updates and monitor applications for suspicious activity.
However, the agency said it was not currently aware of active exploitation associated with the vulnerabilities.
Web hosting provider GoDaddy warned that the flaws could allow attackers to execute code on affected servers over the internet, potentially resulting in stolen data, defaced websites or complete system compromise.
WordPress Websites May Require Manual Updates
The vulnerabilities are particularly significant for WordPress users because the platform relies on PHP running on its server infrastructure.
Wordfence, a security company specialising in WordPress protection, warned that automatic WordPress updates would not install the required PHP security fixes.
Website owners may therefore need to contact their hosting providers or system administrators to ensure their server’s PHP installation is updated.
The PHP security team said further details about the vulnerabilities, affected versions and patched releases would be published when the updates were issued.
CERT-EU and the ACSC warned that versions of PHP dating back to PHP 5 could potentially be affected, although the precise range of vulnerable versions had not yet been disclosed.
For website operators, the immediate priority is to identify affected systems, confirm when the security patches become available and apply them promptly.
Source: Reuters
The post Critical PHP Flaws Put Websites at Risk as Security Patches Loom appeared first on Greek City Times.