Key facts
- Two critical PHP vulnerabilities rated 9.2 on the CVSS v4.0 severity scale are set to be patched.
- CERT-EU and ACSC advised organizations to take affected websites offline if patching is not immediate.
- The vulnerabilities could allow attackers to execute malicious code on vulnerable systems without authentication.
- PHP versions from PHP 5 onward may be affected, though specific versions have not been disclosed.
The developers of the PHP programming language announced on Wednesday that they would release patches for two critical vulnerabilities, as cybersecurity agencies warned organizations to take affected websites offline if they cannot apply the fixes. The vulnerabilities, rated 9.2 on the CVSS v4.0 severity scale, could allow attackers to execute malicious code on vulnerable systems without authentication. Cloudflare reported observing early attacks and was implementing stopgap measures, while GoDaddy noted the potential for code execution leading to data theft or system compromise. CERT-EU and the Australian Cyber Security Centre (ACSC) advised immediate patching and recommended taking sites offline if immediate fixes are not possible. Specific vulnerable PHP versions have not yet been disclosed, but versions from PHP 5 onward may be affected.