The CERC commends organisations’ swift response to critical PHP vulnerabilities: no incidents confirmed to date (30 October 2026)

Following the recommendations issued to organisations using PHP, the Cyber Risk Assessment Unit (CERC), which met on 28 October 2026, has provided an encouraging assessment of the situation. Since the disclosure of two critical vulnerabilities affecting PHP, the relevant authorities have so far observed no proven attempts at malicious exploitation nor any confirmed compromises linked to these vulnerabilities.

At its meeting on 21 October, the CERC had carried out a threat assessment following the publication of these vulnerabilities and issued several recommendations to the organisations concerned.

In particular, the CERC recommended the prompt application of the security patches made available by the software vendors. Where immediate deployment was not feasible, it advised the implementation of appropriate mitigating measures based on a risk analysis and, where necessary, the temporary decommissioning of exposed systems.

Furthermore, system operators were advised to check whether their environments had been compromised and to seek assistance from their designated CSIRT where necessary. These same recommendations were also relayed by GOVCERT to critical entities.

The CERC welcomes the rapid mobilisation of the relevant stakeholders and notes that the measures implemented, in particular the prompt application of security patches, have significantly reduced the risks associated with these vulnerabilities. The situation remains under monitoring, however, and organisations are urged to maintain a high level of vigilance and to continue their security monitoring and updating activities.

CERC participants: HCPN/GOVCERT, ILR, CSSF, CTIE, LHC/CIRCL, the Luxembourg Army, CGIE, Restena, SRE

Released by: Cyber Risk Assessment Unit (CERC)