From BigGo Finance · BigGo Finance · · 1m 20s
PHP Vulnerability Rated 9.2, Highest Severity
EU urges shutdown of unpatched PHP sites after critical vulnerability rated 9.2.
In brief
EU urges shutdown of unpatched PHP sites after critical vulnerability rated 9.2. EU authorities recommend shutting down unpatched PHP sites after two critical vulnerabilities rated 9.2 under CVSS v4.0 could allow remote code execution without authentication. Originally reported by BigGo Finance.
PHP vulnerability critical
PHP development team announced fixes for two critical vulnerabilities rated 9.2 under CVSS v4.0 on Oct. 21.
“CVE-2026-109618”
Remote code execution risk
Flaws could allow attackers to execute code remotely without authentication, raising concerns about internet infrastructure.
EU and Australian guidance
CERT-EU urged organizations unable to apply patches to consider shutting down affected sites or disconnecting from networks.
Australian Cyber Security Centre
ACSC issued similar guidance urging identification of PHP systems and preparation for patches.
Affected versions
PHP 5 and later may be affected but fixes only for supported branches 8.2 through 8.5.
Emergency maintenance in Japan
Japanese services entered emergency maintenance or announced plans to do so from around 11 p.m. on Oct. 21.
Patch release schedule
Fixes scheduled for release at 2 p.m. GMT on Oct. 21 (10 a.m. EDT on Oct. 21).
Critical impact
Vulnerabilities could lead to data theft, website tampering, or full system takeover.
The headline
EU authorities recommend shutting down unpatched PHP sites after two critical vulnerabilities rated 9.2 under CVSS v4.0 could allow remote code execution without authentication.
