WordPress urged site owners to check for PHP updates from their hosts after developers fixed two critical flaws that could let attackers run code on web servers without logging in.
Owners may need to update PHP themselves, WordPress said. It has no update planned for its own software because the vulnerabilities are in PHP, which runs on servers hosting WordPress sites. Changing a site's WordPress files would leave the underlying PHP issue unresolved.
The PHP project released fixes on Oct. 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Each flaw has a severity score of 9.2 under CVSS v4.0. PHP said installations handling web requests need attention, particularly those using Apache's mod_php configuration.
The Cybersecurity Service for the Union institutions, bodies, offices and agencies (CERT-EU) urged organizations to patch affected systems promptly. It advised those unable to patch immediately to consider restricting public access to affected applications until they have installed and checked a fix.
The Dutch government took some websites offline as a precaution. Valtori, Finland's government ICT center, said precautionary shutdowns interrupted public services while operators prepared fixes.
Cloudflare said it observed attack traffic targeting customers and enabled default protections for customers using its web application firewall. Cloudflare Chief Technology Officer Dane Knecht described the firewall measures as temporary.
PHP no longer provides security updates for versions 8.1 and older. Some distributions and long-term support vendors offer backported fixes for those versions; otherwise, operators must move to a supported release. Security support for PHP 8.2 ends Dec. 31, 2026.
