CERT-EU Urges Unpatched PHP Sites to Go Offline Over Critical Flaws
Two PHP vulnerabilities rated 9.2 have prompted EU cybersecurity officials to advise taking unpatched websites offline until fixes are applied.
CERT-EU has advised operators of unpatched PHP websites to take them offline, pointing to two critical vulnerabilities with a severity rating of 9.2. The recommendation applies to sites that have not yet installed fixes.
The advisory highlights the risk from delayed patching of server-side software. PHP is widely used to power dynamic websites, including crypto exchange interfaces, wallet dashboards and block explorer front ends.
Crypto infrastructure exposure
Web-facing systems at crypto companies handle login sessions, API gateways and administrative panels. A critical vulnerability in a runtime like PHP can give attackers a route into those systems if left unaddressed. CERT-EU's advice to switch off affected sites is a short-term containment measure.
Operators should confirm which PHP versions they run, apply vendor patches promptly and watch for updated guidance. Disabling a public site can interrupt service, but leaving a known critical flaw exposed raises the risk of compromise.