EU cyber agency warns websites may have to go offline as attacks emerge ahead of critical PHP patch

Generic imagery of computer hackers. Cloudflare's Dane Knecht warns early attacks are already appearing ahead of today's patch for two PHP flaws each scoring 9.2 on the severity scale.

Both flaws in the PHP programming language score 9.2 on the CVSS severity scale, raising the risk that attackers can run malicious code without even logging in. A fix covering both is due to go live at 2pm GMT today. Cloudflare's chief technology officer Dane Knecht says early attacks are already appearing. PHP underpins WordPress, Drupal, Joomla and Magento, leaving vast swathes of the web exposed.

CERT-EU told organisations unable to patch immediately to consider pulling affected sites offline.

Knecht branded Cloudflare's firewall changes a 'STOPGAP only' and urged everyone to patch.

Security firm Huntress warned: 'PHP is everywhere', including software that never admits using it.

BBC News - TechCyber chiefs tell websites to make critical safety update or go offline LBCWebsites across whole internet may go dark as UK cyber chiefs issue urgent warning over critical security flaws The IndependentSome websites may go down as huge internet vulnerabilities found, cyber agency warns ReutersEU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities Greek City TimesCritical PHP Flaws Put Websites at Risk as Security Patches Loom

Read today's full feed at The Newshound →