• PHP is releasing emergency fixes for two critical vulnerabilities, each rated 9.2/10, that could allow unauthenticated remote code execution.
  • Cloudflare (NET) reports early attacks and is deploying temporary firewall mitigations, but warns they are no substitute for patching.
  • EU and Australian cybersecurity agencies urge immediate action, advising organizations to take vulnerable sites offline if patches cannot be applied promptly.

Critical PHP Vulnerabilities Prompt Emergency Patch

PHP developers are racing to release emergency patches for two critical vulnerabilities that pose a severe risk to millions of websites. The flaws, each assigned a CVSS v4.0 severity score of 9.2 out of 10, could allow attackers to execute malicious code remotely without authentication. The PHP security team has scheduled the release for 14:00 UTC today, though it reserved the right to release earlier if technical details leaked or exploitation emerged. As of 9:32 a.m. EDT, the official page still displayed only an advance notice, leaving the exact affected versions and fixed releases unspecified.

Cloudflare Reports Early Attacks, Deploys Mitigations

Cloudflare CTO Dane Knecht said the company is observing “early attacks emerging” and is updating firewall mitigations as new attack vectors appear. However, Australia’s cybersecurity agency said it was not aware of active exploitation, a discrepancy that may reflect differing visibility rather than a contradiction. Cloudflare, which provides internet infrastructure and security services to millions of organizations, is positioning its response as defensive—its temporary protections are a “STOPGAP only,” Knecht warned, emphasizing that patching is essential.

Government Agencies Issue Urgent Warnings

CERT-EU urged organizations to prepare for immediate patching and advised considering taking affected sites offline if fixes cannot be applied. Australia’s ACSC issued similar guidance, recommending monitoring and preparation. Both agencies cautioned that PHP versions from PHP 5 onward could potentially be affected, though PHP had not yet confirmed the full list. The warning covers potential exposure, not a verified count of vulnerable or breached websites.

Risk of Remote Code Execution

The vulnerabilities enable unauthenticated remote code execution, meaning attackers could run arbitrary code on affected servers without logging in. GoDaddy (GDDY) warned that successful exploitation could lead to data theft, website defacement, or full system compromise. PHP underpins widely used software such as WordPress, Drupal, Joomla, and Magento, so a flaw in the language can create simultaneous remediation work across unrelated businesses and service providers. Hosting providers face a concentrated burden to identify installations and coordinate updates.

Financial and Operational Implications

Cloudflare’s role is defensive mitigation, not ownership or maintenance of PHP. The company’s latest financial results, released August 6, show second-quarter revenue of $696.1 million, up 36% year over year, alongside a GAAP net loss of $170.0 million and adjusted operating income of $96.1 million. Free cash flow was $56.4 million, and cash and securities totaled $4.16 billion. While the PHP emergency may highlight demand for security services, there is no verified evidence of an incident-specific earnings benefit for Cloudflare.

The event also comes amid broader organizational changes at Cloudflare. In May, the company announced an AI-driven restructuring to eliminate more than 1,100 roles, about 20% of its workforce, as it shifts toward an “agentic AI-first” operating model. That restructuring is separate from the PHP emergency.

Regulatory and Historical Context

The EU’s NIS2 framework requires covered organizations to manage cybersecurity risks, including vulnerability handling and supply-chain security, and to report significant incidents within 24 hours and 72 hours. Discovering a PHP installation does not by itself establish a reportable incident. The international response has been coordinated, with guidance also issued by Singapore, which advised looking for PHP in third-party components even if a primary website does not appear to use it.

A relevant precedent occurred in June 2024, when the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2024-4577, a PHP-CGI command-injection vulnerability, to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation. That was a different flaw, but it demonstrates that serious PHP vulnerabilities can progress beyond theoretical risk.

What to Watch

In the short term, the decisive developments will be PHP’s publication of affected versions and fixed builds, the speed of hosting providers’ rollouts, and whether attack reporting expands beyond Cloudflare’s early observations. Until those details are available, claims of universal vulnerability or mass compromise are premature. The clearest expert guidance is to prepare to upgrade as soon as the security release becomes available, and to treat firewall filtering as a temporary measure only.

Update: This article was updated to clarify that Cloudflare’s temporary protections are not a substitute for patching, and that the exact affected PHP versions were not yet specified at the time of publication.