PHP developers release fixes as websites go offline

PHP developers released urgent fixes on Wednesday, October 21, for two critical vulnerabilities that can allow attackers to run unauthorized code on vulnerable servers. They urged users to install the updates immediately. Government agencies and other organisations in several countries took websites or services offline as a precaution while assessing or patching their systems. The vulnerabilities affect PHP, a programming language used to build and operate websites. The U.S. National Security Agency advised organisations to patch affected systems or take them offline if an immediate update was not possible, warning that the flaws could provide access to server files or databases. The vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale. Among the reported precautionary shutdowns, Finland’s state IT provider Valtori took public network services offline, and France’s Interior Ministry placed its websites in preventive maintenance. Dutch organisations also suspended public-facing services, including the country’s National Cyber Security Center website. Denmark’s municipal IT company Kombit shut down several services, including the national school communication platform....