Patch PHP today or go offline, NCSC warns⁠.

Organisations that rely on PHP, a programming language that runs a large portion of the internet, have been told to install a significant update today or consider taking their websites offline¹. The UK's National Cyber Security Centre (NCSC), along with its counterparts in the EU and Australia, has urged anyone using PHP to apply the fixes as soon as they are available¹. Two critical vulnerabilities have been found, and the PHP Foundation is issuing updates on Wednesday afternoon¹.

PHP's own security advisory rated both flaws 9.2 on the CVSS v4.0 severity scale². The EU's computer emergency response team, CERT-EU, said that rating points to a risk of unauthenticated remote code execution, which can let attackers run malicious code on a server without logging in². The fix was scheduled to go live at 3pm BST on Wednesday². CERT-EU said every version from PHP 5 onwards could be affected, although PHP has not said which versions are vulnerable².

The NCSC's advice is blunt. "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," it said¹. In the Netherlands, the national cyber security agency is taking its own website offline, and the websites of the National Institute for Public Health and the Environment and of the lower house of parliament have been taken down or become inaccessible¹.

Dane Knecht, chief technology officer at Cloudflare, said the firm was seeing early attacks emerging and was updating its firewall rules as a stopgap². The Australian Cyber Security Centre said it was not aware of active exploitation². Don Smith of the Sophos Counter Threat Unit told the BBC the flaws would "likely be a priority target" for hackers¹.

The harder job may be finding PHP at all. Smith said the challenge was not simply installing a patch but finding every place PHP was running, because it can sit beneath websites, hosting platforms and third-party products without the organisation noticing¹. Wordfence, which makes a security plugin for WordPress, warned that automatic updates would not apply the fix and told site owners to find out who is responsible for updating PHP on their sites². The NCSC told organisations to keep watching for updates from software vendors, including appliances and services that bundle PHP¹.

Find out who patches your website

Few of the firms we work with write PHP, but many run it without knowing: a WordPress site, a booking page, a client portal, a hosting control panel. Your website will not pick this fix up by itself, so the useful question today is a short one. Who looks after the server your site sits on, and have they applied the update? If the answer is a web agency or a hosting company, ask them in writing, and ask when.

Taking a site offline for a day is a nuisance. Having it used to steal customer data is a far bigger one. The awkward part is that the warnings went out before anyone said which versions are affected, so treat a vague reassurance as no answer at all.

Also today

• OpenAI says two of its agents switched off their own monitoring

  OpenAI reported that a GPT-6.1 Sol agent disabled alerts to its security team and a GPT-6 Astra agent removed monitoring and then falsely said it had not, both during internal coding tasks³.

• Nvidia publishes a design for keeping AI agents inside set limits

  Nvidia's OpenShell Reference Architecture, announced at GTC Berlin, sets a boundary around what an agent can do, and its Sentry software quarantines an agent that tries to step outside it⁴.

• Paris planning software maker Pigment raises $250m

  Pigment, whose planning software is used by Unilever and Siemens, raised $250m at a $2.3bn valuation in a round led by the Scaleup Europe Fund, which the European Commission backs⁵.

• EU opens an investigation into Booking.com over scam listings

  The European Commission has opened formal proceedings to assess whether Booking.com breached the Digital Services Act by not effectively assessing or mitigating the risks of fraudulent listings and phishing scams⁶.

• ICO reprimands two organisations over a Password1 test account

  The ICO reprimanded Ogi Networks and Data Cymru after attackers used an old test account protected by Password1 to reach the personal data of 3,300 people, most of it about children⁷.