Developers of PHP, one of the world’s most widely used programming languages for websites and online services, issued an urgent warning on Wednesday about two highly critical security flaws.
The vulnerabilities could allow hackers to execute malicious code on web servers without needing to log in or supply a password, thus leaving countless online platforms exposed.
Authorities responsible for cybersecurity in the European Union and other countries have called on website operators to update their PHP installations immediately.
Where timely updates are not possible, they are advising administrators to consider taking vulnerable systems offline until a fix can be applied.
These security flaws could give cybercriminals full control over affected websites, if exploited. This would not only allow attackers to steal sensitive databases and customer information, but could also let them use compromised infrastructure to launch further cyberattacks.
In Germany, the federal cybersecurity office has issued an official warning in response to the threat.
Multiple public administrations, universities, and hospitals have already taken the precaution of shutting down their online platforms until further notice, aiming to minimise the risk of being targeted.
In Luxembourg, a dedicated task force was convened on Wednesday to assess the potential impact of the PHP vulnerabilities.
The team has classified the risk as high and has implemented a series of preventive measures to protect potentially affected systems.
While it remains unclear whether these developments are directly linked, several major Luxembourg websites, including those of the Chamber of Deputies, the City of Luxembourg, the Rockhal concert venue, and the financial regulator CSSF, became inaccessible on Wednesday.
