PHP to patch two critical flaws as EU cyber agency warns of remote code execution risk

Websites that cannot be fixed quickly should be taken offline, CERT-EU says

By LineZotpaper

Published21 October 2026

Read Time2 min

Developers of the PHP programming language are to release patches for two critical vulnerabilities rated 9.2 on the CVSS v4.0 severity scale, after European cybersecurity officials warned that organisations unable to apply the fixes should take affected websites offline.

PHP, which underpins a large share of the internet, said in a security update that a patch for both vulnerabilities was scheduled for 2pm and urged users to "upgrade as soon as the release is available". PHP's security team said details of the vulnerabilities, affected versions and the fixed releases would be published when the patches are issued.

The European Union Computer Emergency Response Team (CERT-EU) said in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in. It urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity. "ACSC is currently not aware of active exploitation related to these vulnerabilities," the agency said.

Cybersecurity company Huntress stressed the scale of exposure: "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."

Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.

Analysis

Why This Matters

PHP underpins a large share of the web, so a critical flaw in the language has an unusually broad blast radius.
The 9.2 severity rating signals unauthenticated remote code execution, a class of flaw that can let attackers take over systems without credentials.
Agencies are already signalling that the patch window may be too tight for some organisations, with taking sites offline an acceptable fallback.

Background

PHP is a server-side scripting language that has powered web development for more than two decades. Much of the web's content management, including platforms such as WordPress, Drupal, Joomla and Magento, runs on it, as do many shared hosting environments and control panels. Because the language is embedded in so much software, a core vulnerability forces a co-ordinated response across hosting providers, site owners and security teams.

Key Perspectives

CERT-EU and the ACSC: Both agencies are treating the vulnerabilities as urgent, advising immediate patching, monitoring for malicious activity and, for organisations that cannot patch quickly, taking affected sites offline. Neither agency has reported active exploitation so far. PHP's security team: Has scheduled the patch release and asked users to upgrade as soon as it is available, but is withholding details of affected versions until the fix is out, a common step to limit early exploitation. Security vendors and hosts: Huntress and GoDaddy emphasise how widely PHP is embedded and warn of concrete outcomes including code execution, data theft, website defacement and full system compromise.

What to Watch

Whether the patch release goes ahead as scheduled and which PHP versions it covers.
Whether active exploitation emerges in the hours and days after patch details are published.
How quickly hosting providers and shared platforms roll the fixes out to the sites they manage.

Sources

EU cybersecurity agency in warning on PHP vulnerabilities · RTÉ News

Checked

10 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedPHP is to release patches for two critical vulnerabilities, and EU cybersecurity officials warned that organisations unable to apply the fixes should take affected websites offline.RTÉ News: “The developers of the widely used PHP programming language said they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.”
SupportedThe 9.2 rating indicates a risk of remote code execution without authentication.RTÉ News: “The European Union Computer Emergency Response Team (CERT-EU) said yesterday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution”
Partly supportedWebsites that cannot be fixed quickly should be taken offline, according to CERT-EU.RTÉ News: “CERT-EU urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.”
SupportedThe two vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale.RTÉ News: “In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale”
SupportedPHP scheduled the patch for both vulnerabilities for 2pm.RTÉ News: “It said a patch for both vulnerabilities ‌was scheduled for 2pm.”
SupportedPHP urged users to “upgrade as soon as the release is available”.RTÉ News: “and urged users to "upgrade as soon as the release is available".”
SupportedPHP’s security team said details of the vulnerabilities, affected versions and fixed releases would be published when patches are issued.RTÉ News: “PHP's security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.”
SupportedACSC said it was not aware of active exploitation related to the vulnerabilities.RTÉ News: “"ACSC ⁠is currently not aware of active exploitation related to these vulnerabilities," the agency said.”
SupportedHuntress said PHP powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels and other software.RTÉ News: “"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento ‌sites, shared hosting platforms, control panels, and ⁠an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said in a blog post.”
SupportedAll PHP versions from PHP 5 onward could be affected, but PHP has not disclosed which versions are vulnerable.RTÉ News: “CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.”