PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline

Organizations running internet-facing PHP applications have been advised to take them offline if they cannot immediately patch two critical vulnerabilities. That is how bad this is: the NSA recommended taking affected systems offline until they can be fully mitigated, while CERT-EU urged organizations unable to patch to consider isolating their applications from public networks. The patches are now available. PHP released emergency updates on October 21 , fixing flaws that…