European cybersecurity agency warns of PHP vulnerabilities

CERT-EU, the cybersecurity service for EU institutions, is warning of two critical vulnerabilities in PHP, a programming language widely used for websites around the world. The security flaws could potentially allow attackers to gain remote control of servers.

PHP is widely used for websites and web applications. Well-known examples include Wikipedia, Marktplaats and DPG Media. A large proportion of Dutch municipalities and semi-public institutions also use PHP. As a result, the vulnerabilities could affect a wide range of systems. The level of risk depends, among other things, on the PHP version in use and the configuration of the server concerned.

In the US, cybersecurity company Cloudflare has already observed the first cyberattacks targeting the PHP vulnerabilities. CTO Dane Knecht reported this on the social media platform X.

Security update expected

PHP has announced that it will release a security update on Wednesday, 21 October, at 16:00 Dutch time. The development team may release it earlier if details about the vulnerabilities are leaked or published online.

CERT-EU advises organisations to prepare to install security updates as soon as they become available. If updating is not possible, the agency recommends temporarily disabling internet-connected applications.