Cyber chiefs tell websites to make critical safety update or go offline

UK and European cyber-security authorities are urging organisations that use PHP to install a critical update as soon as it is released, warning that sites may need to go offline if they cannot be protected promptly. The vulnerabilities could let attackers run code remotely without authentication, potentially enabling malware installation or website disruption.

The PHP Foundation is due to issue fixes on Wednesday afternoon, while the Dutch cyber-security agency says it is taking its own website offline. CERT-EU said the flaws could affect PHP versions dating back to version 5, released in 2004, though the full range of affected versions is not yet clear. PHP is widely used by platforms including WordPress, Drupal, Joomla and Magento; Cloudflare’s chief technology officer said early attacks were emerging.