On October 21, critical security issues were identified for PHP Hypertext Preprocessor (PHP), a server-side scripting language. These flaws create a pathway for unauthenticated attackers to infiltrate and run their own code before the system can protect itself, creating a serious risk for anything that relies on PHP. Patches have been released to address this issue and are currently being deployed.
We strongly urge all suppliers to immediately review their use of PHP, apply the necessary updates and ensure that any PHP components exposed to the internet are fully secured or mitigated. Report any cybersecurity concerns to the Supplier Cyber Incident team.
This is an evolving situation, and swift action is essential to protect against potential threats.