“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cyber-security company Huntress said.
Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would “likely be a priority target” for hackers.
The immediate challenge was not simply installing a patch to fix the issue, but finding and managing every instance where PHP was running, he said.
“The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it,” he said.
He said it was crucial that organisations looked out for signs that an attacker “might have already have gained a foothold”.
The European Union Computer Emergency Response Team (CERT-EU) said the risk scores given to the vulnerabilities “indicate the potential for unauthenticated remote code execution”.
Such a cyber-attack could potentially allow hackers to install malware and take down websites.
Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, said he was “seeing early attacks emerging and are updating mitigations as new vectors show up”.
The NCSC said once organisations have installed the update, they should “continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP”.
It is not yet clear which versions of the programming language are affected, but CERT-EU said it could affect all versions of it dating back to PHP 5 onwards – which launched in 2004.
The PHP Foundation has issued the update only for the latest versions however – with people using PHP 8.1 or older being urged to upgrade.
PHP was created for web development. It is used on servers to implement what you see when you visit websites.
Not all websites use it, but it nonetheless powers a large portion of the internet.