It's open on the invisible backbone of the internet. It concerns millions of sites
Vulnerabilities with a severity score of 9.2 detected in PHP put millions of websites around the world at risk of data theft and system takeover.
Quick Look
- Two critical vulnerabilities with a severity score of 9.2 detected in PHP software pose the risk of remote code execution.
- EU cybersecurity body CERT-EU recommended that institutions that cannot apply patches temporarily shut down their sites.
AI-generated summary
Why It Matters
PHP is a common programming language that forms the basis of popular content management systems such as WordPress, Drupal and Joomla.
Two critical security vulnerabilities were detected in the PHP software, which forms the infrastructure of a significant part of the websites.
Cyber security officials of the European Union (EU) called on institutions that cannot update their systems quickly to temporarily close their sites from the internet.
The developer team of the globally widely used programming language PHP announced that patches that will close the security vulnerabilities will be released today at 17.00 Türkiye time.
It was announced that the vulnerabilities received 9.2 points on the CVSS v4.0 severity scale, evaluated out of 10.
The European Union Computer Emergency Response Team (CERT-EU) reported that the risk rating of 9.2 points indicates that attackers can remotely execute malicious code without logging into any system.
CERT-EU stated that organizations unable to apply patches immediately should consider taking relevant sites offline.
GoDaddy, which provides domain name and hosting services, also stated that these vulnerabilities could pave the way for attackers to perform transactions on servers over the internet.
The company warned that this could lead to data theft, defacement of sites or the takeover of the entire system.
According to the news of Reuters agency, cyber security firm Huntress pointed out the prevalence of the software in its evaluation.
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and many other software that doesn't indicate that it uses PHP behind the scenes," the company explained.
Wordfence, which provides security for WordPress sites, reminded that all WordPress sites run on servers with PHP installed.
Noting that automatic updates will not cover this patch, the company advised site owners to find out who is responsible for updating the PHP software on their servers.
What to Watch
AI outlook — possibilities, not facts
Security patches will be released by the PHP developer team.
Very likely · Within hours
Open Questions
- Are attackers already actively using these vulnerabilities?
- What will be the speed at which systems are updated after patches are released?
