Broker Websites May Go Offline as Critical PHP Fixes Roll Out

Brokers with PHP-based websites may temporarily take their public pages offline while applying fixes for two critical security vulnerabilities. Clients won't lose access to their accounts or trading platforms, if they run on separate systems.

The US National Security Agency warned organisations using PHP to prepare for an urgent update. If they cannot install it immediately, the agency recommended taking affected systems offline until the risk can be addressed.

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

— NSA Cyber (@NSACyber) October 21, 2026

Why Websites May Be Taken Offline

The discovered vulnerabilities could allow an attacker to run code on an affected web server without first logging in. PHP’s developers rated both flaws critical and said installations that handle web requests should be updated, with the highest demonstrated risk involving PHP running as an Apache module.

Security fixes are now available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team says temporary safeguards cannot fully remove the risk, making the updates the priority for operators of affected systems.

Taking a website offline while it is secured can interrupt access to public information without shutting down the infrastructure used for client accounts and orders.

• Could AI Threats Be Brokerage Cybersecurity’s Open-Source Moment?
• EDI’s Data Now Available on Athena’s Platform for Trading and Investment Operations
• Cybersecurity Accounts for 63% of Fintech Growth, Study Finds

Brokers Notify Clients of Website Disruption

DEGIRO, an online broker serving investors in 15 European countries, has temporarily taken its public website offline as a precaution because of the PHP vulnerabilities. In a notice displayed to visitors, the broker said clients can still log in, trade and open accounts. It also said the measure affects its website pages, not the security of client accounts.

Phillip Capital Securities Japan has separately warned that server-provider maintenance will make its website unavailable for approximately 30 minutes during an eight-hour window on 23 October. The broker said its client portal and trading functions will continue to operate on separate servers.

Phillip’s clients: they will not be able to reach the login page through the public website during the interruption, even though they can access the portal directly.

For brokers communicating a website outage, that is the detail clients need alongside reassurance that trading remains available.