Thought Leadership
The PHP developers have announced patches for two critical vulnerabilities, due out today. The EU cybersecurity agency CERT-EU is recommending drastic measures: organizations that cannot update immediately should take affected websites offline.
The PHP project has announced security updates for two severe vulnerabilities dubbed PHP2Shell. According to the security advisory, both flaws have a CVSS v4.0 score of 9.2. The patches are scheduled for release at 2 p.m. GMT (4 p.m. CEST). The developers are urging users to update as soon as the fixes become available.
The PHP security team will not disclose details about the vulnerabilities, affected versions, or patched releases until the updates are published. Speculation has been circulating since the previous day that PHP-based websites could face serious attacks.
Remote Code Execution Without Authentication
According to CERT-EU, the severity rating points to the risk of unauthenticated remote code execution (RCE). Attackers could potentially execute malicious code on vulnerable systems without having to log in first. On Tuesday, the agency urged organizations to prepare for immediate patching. If an immediate update is not possible, operators should consider taking affected websites offline.
CERT-EU strongly recommends identifying PHP-based applications and preparing to install patches as soon as fixed versions become available. If an immediate fix is not feasible, organizations should consider isolating internet-facing applications from public networks until a patch can be installed.
Both CERT-EU and the Australian Cyber Security Centre (ACSC) believe that all versions from PHP 5 onward may be affected. The PHP project has yet to officially confirm the scope. The ACSC recommends inventorying PHP systems across organizational environments, preparing updates, and monitoring applications for suspicious activity. At the time of its warning, the Australian agency was not aware of any active exploitation.
Cloudflare Reports Early Attacks, Warns Against Relying on Firewall Rules
Cloudflare takes a more urgent view of the situation. CTO Dane Knecht reported the first attacks on X. The company is continuously updating its firewall rules to address emerging attack vectors. However, Knecht stressed that these measures are only a temporary workaround. Operators should install the update as soon as it becomes available.
Widespread Use of PHP Raises the Stakes
The potential impact is substantial. As security provider Huntress points out in a blog post, PHP underpins content management systems such as WordPress, Drupal, and Joomla, as well as Magento stores, shared hosting platforms, and control panels. Numerous other software products also rely on PHP behind the scenes without explicitly disclosing their use of the language.
Hosting provider GoDaddy warns that attackers could execute code on affected servers over the internet. Potential consequences range from data theft and website defacement to full system compromise.
WordPress Site Owners Must Take Action
Wordfence, the provider of a widely used WordPress security plugin, highlights an important point: every WordPress installation runs on a server that uses PHP. However, WordPress’s automatic updates will not install the PHP security fix. Website owners should therefore determine who is responsible for updating PHP in their environment, whether that is their hosting provider or their own IT team.
Organizations Begin Taking Websites Offline
Numerous organizations have already followed the recommendation. The city of Mainz has temporarily shut down its mainz.de web portal and other online services as a precaution. Berlin’s Charité university hospital is also offline, citing a “global security vulnerability.” The outage affects the hospital’s official website, the Berlin Institute of Health at Charité website, and other services connected to the Charité portal.
Ruhr University Bochum is blocking external access to its websites from 12:30 p.m. today until approximately noon tomorrow. The sites remain accessible from within the university network or via VPN. Businesses are taking precautions as well. Invoicing service easybill has been taken offline, along with the free wiki platform wiki.gg and the website of publisher Choice of Games, all temporarily unavailable.
(Editorial Team)
