EU agency warns unpatched PHP sites may need offline isolation amid critical flaws

The European Union's cybersecurity service for EU institutions, CERT-EU, issued an urgent advisory warning that organizations running vulnerable versions of PHP should consider taking their websites offline if they cannot immediately apply emergency patches.

Emergency warning:

PHP developers announced an emergency patch release to fix two critical vulnerabilities. Rated 9.2 (out of 10) in severity, the flaws carry a high risk of unauthenticated remote code execution (RCE), meaning attackers could run malicious code on targeted servers over the internet without needing login credentials.

Web hosts and security firms like GoDaddy and Wordfence warned that successful exploitation could lead to full system compromise, data theft, or widespread website defacement.

Because PHP underpins a massive portion of the internet—including platforms like WordPress—millions of sites could theoretically be exposed.

CERT-EU advised organizations that cannot patch their systems immediately to isolate or take their internet-facing PHP applications offline until fixes can be safely applied.

While international agencies like the Australian Cyber Security Centre (ACSC) reported no confirmed active exploitations, the emergency disclosure was rushed forward after details leaked online and security researchers successfully reproduced one of the bugs.