European Commission reports no signs its systems were hit by PHP vulnerability

The European Commission says it has no indication that its services or data have been affected by a security vulnerability in PHP, the programming language used by many websites. Its IT security teams have begun applying available updates as a priority, a Commission spokesperson told ANP via Nieuws.nl.

The spokesperson said the Commission was working closely with CERT-EU, the cybersecurity service for EU institutions, and would investigate any signs of possible security problems.

CERT-EU had advised organisations to install security updates as soon as they became available. If an organisation could not do so, it should take internet-connected applications offline, according to the report. The websites of the European Commission, European Council and European Parliament were accessible on Wednesday.

The PHP Foundation has separately said it has seen no signs that previously identified PHP vulnerabilities are being actively exploited. That does not establish whether every affected system has been updated or rule out vulnerabilities being used in future.