- Two critical vulnerabilities in PHP, software used by many websites, have been rated 9.2 out of 10 under a cybersecurity severity scale.
- Cloudflare says it has seen early attacks, while European cybersecurity officials warn that the flaws could allow hackers to take control of vulnerable servers.
- Website owners and hosting providers are being urged to apply patches immediately, while ordinary users should remain alert to suspicious activity.
Millions of websites could face a security risk after developers of widely used website software announced plans to release emergency fixes for two critical vulnerabilities.
The software, called PHP, helps websites display content and run features such as online shopping, account logins and other interactive services. It is used by platforms including WordPress, Drupal, Joomla and Magento, meaning the flaws could affect a broad range of websites.
The vulnerabilities were rated 9.2 out of 10 under the CVSS v4.0 severity scale, which measures the seriousness of security flaws. The European Union's cybersecurity team, CERT-EU, warned that the weaknesses could allow hackers to run malicious code on affected systems without logging in.
PHP said patches for both vulnerabilities were scheduled for release at 14:00 GMT on October 21 and urged users to upgrade as soon as they became available.
What could hackers do?
The main concern is that attackers could exploit vulnerable websites or servers to run malicious code. Depending on how a system is configured, this could lead to data theft, website defacement or a wider compromise of the server.
Cloudflare, a web and cloud security company, said it was seeing early attacks and updating its firewall rules to help block emerging methods. Its chief technology officer, Dane Knecht, described those measures as a temporary stopgap and urged customers to install the official patches once released.
CERT-EU advised organisations to prepare to patch affected systems immediately. Those unable to apply the fixes were told to consider taking vulnerable websites offline until they could be secured.
The Australian Cyber Security Centre issued similar advice, telling organisations to identify PHP systems, prepare to install updates and monitor applications for suspicious activity. It said it was not then aware of active exploitation linked to the vulnerabilities.
Do ordinary website visitors need to worry?
The immediate responsibility lies with website owners, developers and hosting providers, who need to identify affected systems and apply the security fixes.
People browsing websites are not being told to update PHP on their personal devices. However, a compromised website could expose visitors to risks depending on what information they share and how the attack unfolds.
Wordfence, a security service for WordPress websites, warned that automatic WordPress updates would not necessarily install the PHP fixes. Site owners may need to contact their hosting provider or whoever manages their website to confirm that the underlying software has been updated.
PHP's security team said details of the affected versions and fixed releases would be published alongside the patches. CERT-EU and the Australian Cyber Security Centre warned that versions from PHP 5 onwards could be affected, although the precise scope had not yet been disclosed.
For businesses and website operators, the priority is to identify whether their systems are vulnerable and apply the official updates promptly. For ordinary users, the practical advice is to avoid suspicious links, be cautious about entering sensitive information on unfamiliar websites and follow any security guidance issued by services they use.
