On Wednesday 21 October 2026, Luxembourg’s Cyber Risk Assessment Unit (CERC) and the Commission for the Supervision of the Financial Sector (Commission de Surveillance du Secteur Financier - CSSF) issued warnings in relation to the potential impact of recently discovered PHP vulnerabilities on Luxembourg websites.
PHP is a widely used programming language for developing and operating websites and online applications and due to its widespread use, the identified vulnerabilities could affect a large number of systems and services worldwide.
In a press release, the CERC advised that following the disclosure of two critical vulnerabilities affecting PHP, it had met on Wednesday 21 October to assess the risks to information systems in Luxembourg and coordinate the necessary precautionary measures.
CERC said that, in response to this situation, Luxembourg authorities have taken several preventive measures to reduce exposure to risk and strengthen the protection of potentially affected systems, with the State promptly taking the necessary precautionary measures for potentially affected government systems. In particular, the government’s IT centre (Centre des technologies de l’information de l’État - CTIE) temporarily made certain services unavailable as a preventive measure.
The authorities recommended that system operators contact their designated CERT (Computer Emergency Response Team) for any assistance they may require.
CERC added that the relevant services are continuing their technical analysis of the incident, as well as assessing whether additional precautionary measures are warranted.
In a separate press release, the CSSF strongly recommended that all supervised entities concerned duly take note of this report and take appropriate action. In addition, as the unauthenticated remote code execution consists of an unauthorised malicious access, the CSSF reminded all supervised entities that this constitutes a major ICT-related incident that needs to be notified, according to either Circular CSSF 25/893 (DORA) or CSSF 24/847, depending on the type of entity.
These warnings come as Europe marks cybersecurity month and ahead of the Luxembourg Commercial Internet Exchange Association (LU-CIX) event Luxembourg Internet Days, which this year will focus on cybersecurity, sovereignty and resilience, as well as amid a rise in instances of cyberattacks in Luxembourg in recent years.
