Organizations that can't quickly patch two critical flaws in PHP should consider taking their websites offline, the EU's cybersecurity response team has warned.
CERT-EU, which protects the EU's institutions and bodies, issued the advice ahead of the fix. The PHP project will release patches at 14:00 UTC on Wednesday, October 21. For any site that can't be updated fast after that, the team's guidance is that pulling it from the internet may be the safer option.
PHP is a scripting language that runs a large share of the web, which explains the attention paid to a pair of critical bugs. It often sits underneath content management systems and older custom code, and those are usually the hardest things to update in a hurry. Administrators should check the project's release notes for which versions the flaws touch.
Telling people to switch off a website is a heavy ask. Security agencies more often say "patch now", so the offline advice implies the cost of being exploited outweighs the cost of downtime. That trade is easier for a public institution than for a retailer losing sales by the hour, and the warning reads as written with the first group in mind.
The timing also matters. Once a patch is public, anyone can compare the old and new code to work out what was wrong, a common route from fix to working exploit. The risky stretch is therefore the gap between the release and the moment each site actually gets updated. The open question is how many organizations can say, within hours, exactly where PHP runs across their systems.