EU cybersecurity agency in warning on PHP vulnerabilities

The European Union's cybersecurity agency, CERT-EU, has issued a warning about critical vulnerabilities in the widely used PHP programming language. Developers of PHP have announced they will release patches for two highly severe flaws, rated 9.2 on the CVSS v4.0 scale. These vulnerabilities could allow unauthenticated remote code execution, potentially granting attackers the ability to run malicious code on affected systems without logging in.

PHP is a foundational technology powering a vast majority of the internet, including popular content management systems like WordPress, Drupal, Joomla, and Magento, as well as shared hosting platforms and control panels. Huntress, a cybersecurity company, noted that PHP is embedded within countless systems that don't explicitly disclose its usage.

CERT-EU advised organizations to prepare for immediate patching of affected systems, and those unable to apply the patches should consider taking affected websites offline to mitigate risk. The Australian Cyber Security Centre (ACSC) echoed this guidance, urging organizations to identify PHP systems within their environments, prepare for patching, and monitor applications for signs of malicious activity. As of now, the ACSC is not aware of any active exploitation related to these vulnerabilities.

Web hosting provider GoDaddy highlighted the potential consequences, stating that attackers could exploit these vulnerabilities to execute code on affected servers over the internet, leading to data theft, website defacement, or full system compromise. PHP's security team has stated that details regarding the affected versions and the fixed releases will be made public once patches are made available.

Both CERT-EU and the ACSC emphasized that all PHP versions from PHP 5 onward could be impacted, though specific vulnerable versions have not been disclosed by PHP.