European sites offline as PHP patch rolls out
Two critical PHP vulnerabilities prompt sites to shut down ahead of patch release.
Key facts
- Two PHP vulnerabilities rated 9.2/10 affect all versions from PHP 5 onward.
- The Finnish government, Edinburgh council, BBC, and Dutch agencies have taken sites offline.
- CERT‑EU says the flaws enable unauthenticated remote code execution.
- More than 1.3 million internet‑connected hosts are likely affected.
- WordPress powers over 40% of the web, making all WordPress sites vulnerable.
PHP developers announced a patch today at 10AM ET to fix two critical vulnerabilities. The flaws have a severity rating of 9.2/10 and allow remote code execution on every PHP version from PHP 5 onward.
Security researchers estimate more than 1.3 million hosts are affected. WordPress, which powers more than 40% of the internet, is fully vulnerable because all WordPress sites run on PHP.
The UK National Cyber Security Centre and the EU Computer Emergency Response Team advised organisations to apply the patch or take sites offline. The NCSC noted that if immediate remediation is not possible, sites should be isolated from public networks.
The Finnish government, Edinburgh council, BBC, and Dutch agencies have already taken sites offline. Cloudflare CTO Dane Knecht reported early attacks emerging and that the company is updating firewall rules.
Context
PHP is a programming language used on servers to build websites. Vulnerabilities in PHP can allow attackers to run code on servers, potentially taking sites offline.
How outlets headlined it
How this was made
Compiled by our AI newsroom from 2 independent outlets, checked by a separate AI editor against the sources. Only claims found in the sources are reported. Spot an error? Every source is linked below.
Correction or source request? simoneggert16@gmail.com
Open reader debate: Factual contributions and additions are synchronized directly in real time across all readers.
Loading contributions from cloud server…
Reader Discussion & Community Notes