Australia's own cybersecurity website is among services affected after an alert about a major vulnerability in a widely-used internet programming language that hackers are believed to be exploiting.
Developers of the PHP programming language have identified two critical vulnerabilities and have been urging website operators to run an update to fix the issues.
PHP underpins large parts of the internet, raising concerns that a significant number of websites could be vulnerable to attack.
Among those known to be affected are European government departments and popular sites like Wikipedia.
The Australian Signals Directorate said on Wednesday that cyber.gov.au was among Australian government websites affected by a "critical" PHP issue.
"Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available," the ASD said on X.
Government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.
The Australian Cyber Security Centre, within intelligence agency the Australian Signals Directorate, is affected by the PHP issue. (ABC News: Mark Moore)
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said in a blog post.
Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.
"We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X.
Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied.
Wikipedia says it is implementing the fix to its websites after the vulnerabilities were discovered. (Reuters: Gary Cameron )
The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.
Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable.
Critical software
PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.
It is also among the most widely used software on the internet.
PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs.
It is the engine behind WordPress, which powers about 43 per cent of all websites from blogs and small business pages to government portals, online stores and news sites.
Security experts said the vulnerabilities could potentially open the door to millions of servers because so many websites rely on the same underlying software.
Rather than target victims individually, attackers could scan the internet for systems running vulnerable versions of PHP.
Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform, a spokesperson told Reuters.
Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline "as a precautionary measure."
France's Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.
The US cybersecurity agency CISA did not respond to emails seeking comment.
ABC/Reuters