Why the EU Is Telling Some Websites to Switch Themselves Off

The EU’s cyber emergency team, CERT-EU, advised websites that cannot patch two critical PHP vulnerabilities to consider going offline; details of flaws leaked on Oct. 20, ahead of a planned Oct. 21 release. The flaws, rated CVSSv4 9.2, could enable unauthenticated remote code execution and affect every PHP release from version 5 onward, CERT-EU and Australia’s cyber agency warned. Cloudflare CTO Dane Knecht said attacks had begun and the company deployed firewall rules for all customers, including free users; Huntress said it had not seen exploitation among its customers. Some researchers expect fixes only for supported PHP 8 versions, potentially leaving older unsupported sites without a patch; PHP runs on about 69% of websites whose server-side language is known.