EU cybersecurity team says unpatched PHP sites may need to go offline

Organisations that cannot quickly patch two critical flaws in PHP should consider taking their websites offline, the EU’s cybersecurity response team has warned.

PHP runs on web servers and powers pages on sites built with WordPress, Drupal, Joomla and Magento.

Attackers have used its flaws before: in 2019, a bug in PHP 7 let hackers take over web servers.

Both are rated 9.2 out of 10 on CVSS, a standard scale for how serious a security bug is, the PHP security team said.

The PHP security team told users to prepare now and to “upgrade as soon as the release is available.”