BAGANBAZAR GRAPHEXPLORE · ANALYZE · GROW
Theme
LiveDesk
BusinessEU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilitiesWorldOpenAI says its AI agents weakened internal monitoring systemWorldTrump administration says it has revoked over 300,000 visasWorldZelenskyy hails resumption of US advance warning of strikes on UkraineWorldDow outperforms as Wall Street rises, healthcare stocks lead gains
Business/Source-attributed reporting
Business DESK

EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

THE DEVELOPERS of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organizations unable to apply the fixes should take affected websites offline. PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions. “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post. In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”. It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday. The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in. CERT-EU urged organizations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline. The Australian Cyber Security Center (ACSC) issued similar guidance, urging organizations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity. “ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said. Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affe

Published Oct 21, 2026 · 4:45 AMOriginal source: BusinessWorld1 reads
THE DEVELOPERS of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organizations unable to apply the fixes should take affected websites offline. PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions. “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post. In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”. It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday. The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in. CERT-EU urged organizations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline. The Australian Cyber Security Center (ACSC) issued similar guidance, urging organizations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity. “ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said. Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise. PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued. CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable. — Reuters
ORIGINAL SOURCE

BusinessWorld

This report is indexed by BAGANBAZAR GRAPH with its original publisher named and linked for readers.

Read at original outlet ↗
RELATED COVERAGE

More from this desk.

BAGANBAZAR GRAPHSource-attributed newsBUSINESS desk
Business

Malaysia bans civil servants from using mapping app Waze, citing links to Israel

KUALA LUMPUR — Malaysia has banned civil servants from using Alphabet’s navigation app Waze after Prime Minister Anwar Ibrahim said its origins in Israel raised security concerns. Muslim-majority Malaysia is a staunch supporter of the Palestinian ​cause and does not maintain diplomatic relations with Israel. Mr. Anwar said on Tuesday that the government was looking into potential security risks arising from the use of Waze, which he said “was bound to Israeli laws.” “We cannot compromise on the security of people’s data and identities,” he said in a Facebook post after chairing a national cybersecurity committee meeting. Mr. Anwar did not provide any details of the risks but recommended the use of TuJu, a domestic mapping app developed by the Malaysian Highway Authority, as an alternative. Malaysia’s Chief Secretary to the Government Shamsul Azri Abu Bakar said all civil servants would now be barred from using Waze, according to a letter dated Tuesday and addressed to the heads of government agencies. The letter, reviewed by Reuters, said the directive followed a decision taken at the meeting chaired by Mr. Anwar, with the prohibition to take effect immediately. An official with the Prime Minister’s Department confirmed the letter’s authenticity. Waze, which was founded in Israel, uses satellite signals and crowd-sourced data from drivers to offer real-time traffic information. It was acquired by Alphabet-owned Google in 2013 for about $1 billion. — Reuters

Original sourceBusinessWorld