On Friday 30 October 2026, Luxembourg’s Cyber Risk Assessment Unit (CERC) reported that following the recommendations issued to organisations using PHP, it met on Wednesday 28 October and has provided a positive assessment of the situation.
The CERC said that since the disclosure of two critical vulnerabilities affecting PHP, the competent authorities have, to date, identified neither any confirmed attempts at malicious exploitation nor any confirmed compromises linked to these vulnerabilities.
At its meeting on Wednesday 21 October, the CERC had assessed the threat arising from the publication of these vulnerabilities and issued several recommendations for the organisations concerned.
In particular, the CERC recommended the prompt installation of security patches made available by software vendors. Where their immediate deployment was not feasible, it had advised implementing appropriate compensatory measures based on a risk assessment and, where necessary, temporarily taking exposed systems out of service.
In addition, operators had been invited to check whether their environments had been compromised and to seek assistance from their designated CSIRT where necessary. The same recommendations had also been circulated by GOVCERT to critical entities.
The CERC said it welcomes the swift response of the stakeholders concerned and notes that the measures implemented, particularly the prompt application of security patches, have significantly reduced the risks associated with these vulnerabilities.
Nevertheless, the CERC stressed that the situation remains under close monitoring, and organisations are encouraged to maintain a high level of vigilance and continue their security monitoring and updating activities.
CERC participants: HCPN/GOVCERT, ILR, CSSF, CTIE, LHC/CIRCL, Luxembourg Army, CGIE, Restena and SRE.
