EU cybersecurity team says unpatched PHP sites may need to go offline

Organisations that cannot quickly patch two critical flaws in PHP should consider taking their websites offline, the EU’s cybersecurity response team has warned. PHP powers a large share of the web. The PHP project will release fixes at 14:00 UTC on Wednesday, October 21.

CERT-EU, which protects the EU’s institutions and bodies, issued the advice in an advisory published Tuesday evening. The Australian Cyber Security Centre (ACSC) issued similar guidance.

PHP runs on web servers and powers pages on sites built with WordPress, Drupal, Joomla and Magento. Attackers have used its flaws before: in 2019, a bug in PHP 7 let hackers take over web servers.

The two new flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on CVSS, a standard scale for how serious a security bug is, the PHP security team said.

According to CERT-EU, that rating points to a risk of unauthenticated remote code execution. In plain terms, an attacker could run their own code on a server over the internet, without a password or login.

CERT-EU said every PHP version from PHP 5 onwards could be affected, though it based that on social media posts rather than on PHP itself. PHP has not yet said which versions are vulnerable or which releases fix them. Those details will come with the patches.

The PHP security team told users to prepare now and to “upgrade as soon as the release is available.”

The release arrives earlier than planned. Claims about the flaws spread online on Monday, ahead of the scheduled disclosure date. Researchers at security firm watchTowr then said they had reproduced one of the bugs, according to Huntress.

PHP then moved its release forward by a day, and said it could ship sooner if details became public or attacks began. No attacks have been confirmed so far.

“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the Australian agency said.

Even so, web host GoDaddy warned that the flaws could let attackers steal data, deface websites or take full control of servers. CERT-EU told organisations to identify every PHP application they run and prepare to patch them all at once.

Where that cannot happen, organisations should “consider isolating internet-facing applications from public networks until a fix can be applied,” CERT-EU said.