欧盟网络安全响应小组警告称，无法迅速修补 PHP 两个严重漏洞的组织应考虑将其网站下线。PHP 为网络上很大一部分网站提供支持。PHP 项目将于 10 月 21 日（周三）14:00 UTC 发布修复补丁。
Organisations that cannot quickly patch two critical flaws in PHP should consider taking their websites offline, the EU’s cybersecurity response team has warned. PHP powers a large share of the web. The PHP project will release fixes at 14:00 UTC on Wednesday, October 21.
保护欧盟机构和实体的 CERT-EU 于周二晚间发布的通报中提出了上述建议。澳大利亚网络安全中心（ACSC）发布了类似指导意见。
CERT-EU, which protects the EU’s institutions and bodies, issued the advice in an advisory published Tuesday evening. The Australian Cyber Security Centre (ACSC) issued similar guidance.
PHP 运行在 Web 服务器上，为使用 WordPress、Drupal、Joomla 和 Magento 构建的网站提供页面支持。攻击者曾利用其漏洞：2019 年，PHP 7 中的一个漏洞让黑客接管了 Web 服务器。
PHP runs on web servers and powers pages on sites built with WordPress, Drupal, Joomla and Magento. Attackers have used its flaws before: in 2019, a bug in PHP 7 let hackers take over web servers.
这两个新漏洞的编号为 CVE-2026-109618 和 CVE-2026-109619。PHP 安全团队表示，两者在 CVSS（一种衡量安全漏洞严重程度的标准评分体系）上的评分均为 9.2 分（满分 10 分）。
The two new flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on CVSS, a standard scale for how serious a security bug is, the PHP security team said.
据 CERT-EU 称，该评分指向未经身份验证的远程代码执行风险。通俗地说，攻击者可在无需密码的情况下，通过互联网在服务器上运行自己的代码。
According to CERT-EU, that rating points to a risk of unauthenticated remote code execution. In plain terms, an attacker could run their own code on a server over the internet, without a password or.
CERT-EU 称，从 PHP 5 起的每个 PHP 版本都可能受影响，但这一判断基于社交媒体帖子，而非 PHP 官方信息。PHP 尚未说明哪些版本存在漏洞，也未说明哪些版本修复了漏洞。这些细节将随补丁一同公布。
CERT-EU said every PHP version from PHP 5 onwards could be affected, though it based that on social media posts rather than on PHP itself. PHP has not yet said which versions are vulnerable or which releases fix them. Those details will come with the patches.
PHP 安全团队建议用户提前做好准备，并在“发布可用后尽快升级”。此次发布比原计划提前。关于漏洞的传言于周一在网上扩散，早于原定披露日期。据 Huntress 称，安全公司 watchTowr 的研究人员随后表示已复现其中一个漏洞。
The PHP security team told users to prepare now and to “upgrade as soon as the release is available.”The release arrives earlier than planned. Claims about the flaws spread online on Monday, ahead of the scheduled disclosure date. Researchers at security firm watchTowr then said they had reproduced one of the bugs, according to Huntress.
PHP 随后将发布时间提前一天，并表示如果细节公开或出现攻击，可能会更早发布。目前尚未确认发生攻击。
PHP then moved its release forward by a day, and said it could ship sooner if details became public or attacks began. No attacks have been confirmed so far.
澳大利亚网络安全中心表示：“ACSC 目前未发现与这些漏洞相关的活跃利用行为。”
“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the Australian agency said.
即便如此，网络托管商 GoDaddy 警告称，这些漏洞可能让攻击者窃取数据、篡改网站或完全控制服务器。CERT-EU 告诉各组织要识别其运行的每一个 PHP 应用程序，并准备一次性为所有应用程序打补丁。
Even so, web host GoDaddy warned that the flaws could let attackers steal data, deface websites or take full control of servers. CERT-EU told organisations to identify every PHP application they run and prepare to patch them all at once.
CERT-EU 表示，如果无法做到这一点，组织应“考虑将面向互联网的应用程序与公共网络隔离，直到能够应用修复补丁为止”。
Where that cannot happen, organisations should “consider isolating internet-facing applications from public networks until a fix can be applied,” CERT-EU said.