EU cybersecurity agencies urge immediate patching of two critical PHP flaws

The European Commission (DG CNECT), ENISA, CERT-EU, Europol's European Cybercrime Centre (EC3) and the EU CSIRTs network published on 21 October, according to ENISA, a joint recommendation on two vulnerabilities in PHP, the language on which a large share of websites run. According to ENISA, the flaws could allow an attacker to remotely execute malicious code on vulnerable servers without needing to authenticate. The PHP security team released the updates that same day at 13:40 UTC, according to the same note.

The agencies recommend locating all PHP-based applications, including those that use it internally without it being visible, coordinating with hosting providers and applying the patches starting with internet-facing systems. If they cannot be fixed immediately, ENISA advises considering isolating exposed applications from public networks until they can be updated.

According to the Canadian Centre for Cyber Security, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and earlier no longer receive official patches. On 23 October that agency added a third related flaw, CVE-2026-115560, still unpatched, for which the PHP team recommends disabling the session.upload_progress.enabled option.

Several administrations took websites offline as a precaution. According to Reuters, the French Interior Ministry temporarily disconnected the prefectures' websites pending the patch, and the Australian agency AAP reported precautionary shutdowns in Germany, Finland, Belgium and on websites of the Dutch public health institute RIVM.

The degree of actual exploitation is unclear. The Canadian agency said a public proof of concept exists but it had not detected active exploitation. The SANS Internet Storm Center reported on 23 October that Cloudflare and Amazon were observing a large number of exploitation attempts, although with no evidence that they were successful attacks or of mass exploitation.