Meeting of the Cyber Risk Assessment Unit (CERC) – Recommendations for organisations using PHP following the release of security patches (21 October 2026)

Following the release, on the afternoon of 21 October 2026, of security patches addressing two critical vulnerabilities affecting PHP, the Cyber Risk Assessment Unit (CERC) met once again to assess the situation and coordinate the necessary measures.

In this context, Luxembourg’s Computer Security Incident Response Teams (CSIRTs) have already contacted the organisations within their respective communities to inform them of the risks associated with these vulnerabilities. In their communications to the organisations concerned, they have, in particular, recommended the prompt application of the published patches, as well as the implementation of appropriate protective measures where immediate installation of the patches is not possible.

The CERC reiterates these recommendations (https://www.circl.lu/pub/tr-102/) and urges all operators of systems using PHP to apply the published patches to the affected systems as soon as possible.

Where immediate application of the patches is not possible, operators are advised to carry out a risk assessment taking into account their operational context and to implement appropriate mitigating measures. Where necessary, the temporary shutdown of exposed systems should also be considered in order to reduce operational risk.

System operators are also urged to check whether their systems may have been compromised and to contact their designated CSIRT should they require assistance.

The Government has taken the necessary precautionary measures without delay for any state systems that may be affected. In particular, the CTIE has temporarily taken certain services offline as a preventive measure.

The relevant departments are continuing their technical analyses and are monitoring the situation closely.

Participants at the CERC : HCPN/GOVCERT, ILR, CSSF, CTIE, LHC/CIRCL, Armée luxembourgeoise, CGIE, Restena

Issued by: Cyber Risk Assessment Unit