Platforms · Software · Providers · Markets
PHP flaws put public servers at risk
On 21 October 2026, the US National Security Agency urged organisations running PHP to prepare for an urgent security update. It advised taking affected systems offline if an immediate update is not possible. The warning concerns two critical vulnerabilities that could let an attacker execute code on a web server without logging in first.
PHP's developers have released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Their highest demonstrated risk is associated with PHP running as an Apache module.
The PHP team says temporary protections do not fully address the vulnerabilities, and recommends updating installations that process web requests. A public site can be taken down while secured without necessarily interrupting account and order systems hosted separately.
Broker websites stay apart from trading
DEGIRO has taken its public website offline as a precaution. The online broker serves investors in 15 European countries and says its customers can still sign in, place trades and create accounts. Its notice says the action applies to public-facing pages, not the safety of client accounts.
Phillip Capital Securities Japan has warned that maintenance by its server provider will interrupt its website for approximately 30 minutes within an eight-hour window on 23 October. The firm says trading and its client portal will run on separate servers.
Customers will not be able to use the public site to reach the login page during the interruption, although they can go straight to the portal. The outage details were also reported by Finance Magnates.
| Figure | Detail |
|---|---|
| PHP fixed releases | 8.2.35, 8.3.36, 8.4.27 and 8.5.12 |
| DEGIRO coverage | 15 European countries |
| Phillip website interruption | Approximately 30 minutes |
| Maintenance period | Eight-hour window on 23 October |
What an operations team should check
Identify which public-facing services run PHP and establish their versions and deployment configurations, including whether PHP runs as an Apache module. Check whether those systems can be moved to a fixed release promptly. If not, the NSA's advice is to take affected systems offline until the risk is addressed; the PHP team says temporary safeguards are not a complete substitute for the updates.
Map the customer journey from public pages to account login, the client portal and order entry. Confirm which services remain reachable if a website is withdrawn, and whether clients need a direct portal address. When planning an outage notice, specify what is unavailable, what remains operational and how customers can reach the login route during the interruption.
