Security patches for PHP, the server-side language that underpins a large share of the web, began rolling out on Wednesday at 10AM ET to close two critical vulnerabilities that could let attackers execute their own code on affected servers. The PHP project rated the flaws 9.2 out of a possible 10 in an advisory published Tuesday, and some national cybersecurity agencies advised operators who cannot patch immediately to take internet-facing systems offline rather than leave them exposed.

What the flaws allow

According to cybersecurity firm watchTowr, both issues are remote code execution exploits that affect every PHP version from PHP 5 onward. Successful exploitation would let an attacker run arbitrary code on a vulnerable server, opening the door to defacing websites, exfiltrating data and other compromises. The PHP project urged users to upgrade as soon as the release became available.

The exposure is unusually broad. One security researcher estimated that more than 1.3 million internet-connected hosts are likely affected. Wordfence, which maintains a widely used WordPress security plugin, warned that every WordPress site is exposed because all of them run on PHP servers — and WordPress reported last year that it powers more than 40 percent of the internet. Wordfence also cautioned that the fix cannot be delivered through automatic updates, meaning site owners must identify who manages PHP on their infrastructure and apply the patch manually.

Agencies advise isolation, not just patching

The European Union Computer Emergency Response Team and the UK National Cyber Security Centre both issued advisories recommending that organisations unable to patch right away isolate internet-facing applications from public networks or take them offline entirely until the vulnerabilities are fully mitigated. GrapheneOS, the mobile operating system project, said it had temporarily taken its user discussion forum offline because proof-of-concept exploits were already being developed and it did not want to take the risk.

PHP developer Gina Peter Banyard said patching is the only real mitigation, and that otherwise shutting servers down "might be the most sensible thing to do."

Attacks are already underway

Threat researchers at Sansec said they expect mass attacks within 15 minutes of the release, and there are signs that exploitation did not wait for the patch. Cloudflare chief technology officer Dane Knecht said the company was already seeing early attacks against PHP sites on its platform and was temporarily updating its firewall rules as a stopgap until the fix was available.

The timing puts pressure on administrators who may not know where PHP runs in their stack. Because the language is frequently bundled into hosting environments and container images, patching often depends on a hosting provider, a platform team or a managed service rather than the site owner. That makes inventory the first practical step: finding every PHP runtime in production and confirming which versions are in use before applying the upgrade.

Why this matters beyond one language

PHP's reach into content management systems, forums and custom web applications means a single high-severity flaw in the runtime can cascade across millions of independent sites that share little else in common. The response from Cloudflare and the warnings from Wordfence illustrate how much of the web's defensive posture depends on a small number of shared components, and how quickly edge providers must react when a core runtime is compromised.

The immediate priority for operators is to apply the patched release, verify that automatic update mechanisms did not silently skip the runtime, and confirm with hosting providers that shared environments have been upgraded. Where patching cannot happen quickly, the guidance from EU-CERT and the NCSC is explicit: remove the exposure rather than hope the window stays closed.