Warning websites may go dark as critical fix prepared

Key points

• The developers of the PHP programming language are releasing patches for two critical vulnerabilities. PHP is used across large parts of the internet.
• Its security update rates both flaws 9.2 out of 10 on the CVSS v4.0 severity scale and urges users to upgrade once the release is available. The European Union Computer Emergency Response Team warned the flaws could allow attackers to run malicious code without logging in, and advised organisations that cannot patch to consider taking affected sites offline.
• The Australian Cyber Security Centre said it is not aware of active exploitation.