EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
GDDY•PHP said it would release patches for two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale. CERT-EU said organisations unable to apply fixes should consider taking affected sites offline.
1. Patches scheduled Wednesday
PHP said it would release patches for two critical vulnerabilities at 1400 GMT on Wednesday and urged users to upgrade as soon as they were available. It said details of the vulnerabilities, affected versions and fixed releases would be published when the patches were issued.
2. Agencies urge preparation
CERT-EU said the 9.2 severity rating indicated a risk of unauthenticated remote code execution, which can let attackers run malicious code without logging in. It urged organisations to prepare to patch affected assets and consider taking sites offline if they could not apply the fixes. The Australian Cyber Security Centre advised organisations to identify PHP systems, prepare to patch and monitor for malicious activity, while saying it was not aware of active exploitation.
3. Potential impact
CERT-EU and the Australian agency said all PHP versions from PHP 5 onward could be affected, although PHP had not disclosed the vulnerable versions. GoDaddy said the flaws could lead to data theft, website defacement or full system compromise.
