EU Agency Tells Websites to Consider Going Offline Over PHP Bugs

The European Union's cyber emergency response team advised websites unable to apply fixes for two severe PHP flaws to contemplate taking their sites offline. Exploitation of either vulnerability could allow attackers to seize control of web servers with no authentication required.

PHP underpins a substantial portion of the internet, powering platforms ranging from WordPress blogs to Magento online stores. But technical specifics of both vulnerabilities became public before the patches were issued.

Attackers Got a Head Start

According to Huntress, the leak emerged on October 20, before the intended announcement. The PHP Foundation's security team subsequently set the release time for October 21 at 14:00 UTC.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

— The PHP Foundation (@ThePHPF) October 20, 2026

Security company watchTowr managed to replicate one of the two vulnerabilities, Huntress reported. Huntress noted that it had not observed any exploitation among its clients' systems.

Cloudflare's chief technology officer Dane Knecht, however, stated that attacks are already underway. The firm has implemented firewall rules covering the identified attack vectors for all its customers, including those on free plans.

We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only.

Knecht posted the alert on X.

Both the European Union Computer Emergency Response Team (CERT-EU) and Australia's cyber agency cautioned that the PHP flaws could impact all versions starting from PHP 5, as reported by Reuters.

Huntress noted that some researchers anticipate patches only for the currently supported PHP 8 versions. This situation could leave websites running older, unsupported PHP versions without any remedy.

This warning comes weeks after over 100 companies cautioned that AI-driven cyberattacks could surge within months.

What PHP Vulnerabilities Mean for Website Owners

According to W3Techs, PHP is used on approximately 69% of websites where the server-side language is identifiable. WordPress alone accounts for around 40% of all websites.

CERT-EU stated that the 9.2 severity rating indicates unauthenticated remote code execution capability. In simpler terms, an external actor could execute malicious code on a server without needing any login credentials.

Web hosting provider GoDaddy warned that attackers might steal data, deface websites, or completely take over a system. The value of stolen records is evident from the South Korean bank breaches.

Wordfence, a security plugin, pointed out that every WordPress site runs on a PHP server. However, WordPress's automatic update mechanism cannot address these PHP vulnerabilities. Consequently, site owners must determine who is responsible for their PHP management.

Incidents targeting everyday infrastructure continue to increase, exemplified by the French supermarket fridge hack in October. These PHP vulnerabilities move the threat to the software layer underpinning much of the web, where a single missed server update can create an entry point.