Critical vulnerabilities identified in PHP programming language

Developers of the widely used PHP programming language have released patches for two critical vulnerabilities, following an urgent warning from EU cybersecurity officials. Both security flaws are rated 9.2 on the CVSS v4.0 scale, indicating a high risk of unauthenticated remote code execution. The patches were made available on Wednesday at 14:00 GMT, with developers strongly urging all users to update their systems immediately to prevent potential cyber intrusions.

PHP powers a significant portion of the internet, including platforms like WordPress, Drupal, Joomla, and Magento. Following the initial disclosure, reports emerged that hackers were already attempting to exploit these flaws. As a precautionary measure, several government websites in the Netherlands and Finland were taken offline. The EU Computer Emergency Response Team (CERT-EU) had advised that organizations unable to apply the patches should disable affected websites to mitigate the risk of unauthorized access. Cybersecurity analysts noted that the widespread nature of the software makes this an extensive threat, as many systems run PHP silently in the background without clear visibility.