Critical Security Vulnerabilities in PHP

Because the exact affected PHP versions have not yet been confirmed, the CSSF advises supervised entities to treat every PHP-powered service as potentially exposed. This is a cross-sector operational resilience and cyber incident reporting issue, not merely a technical patch notice. Compliance teams should immediately coordinate with ICT and security functions to inventory PHP dependencies, review the CIRCL technical report, validate exposure, apply mitigations or compensating controls, and preserve evidence in case malicious access is detected.

The CSSF also reminds entities that unauthorised malicious access through unauthenticated remote code execution may qualify as a major ICT-related incident requiring notification under Circular CSSF 25/893 (DORA) or CSSF 24/847, depending on entity type. Boards and senior management should seek assurance that vulnerability management, incident classification, third-party oversight and regulatory notification processes are operating effectively. Firms should not wait for confirmed version information before taking risk-based action.

Key actions include patching where possible, restricting internet-facing PHP services, enhanced monitoring, incident response readiness and timely regulatory engagement if an incident is identified. The alert reinforces DORA expectations around ICT risk management, incident reporting and operational resilience.