Government websites and online services across Europe and elsewhere were taken offline on Wednesday after developers disclosed critical security vulnerabilities in PHP, a programming language used by a large share of the internet.
PHP developers released emergency security fixes on Wednesday and urged users to update their software immediately. Cybersecurity companies warned that some attackers were already exploiting the flaws, prompting organizations to disable vulnerable services while they assessed the risks and applied patches.
Experts said the public disclosure of the vulnerabilities, combined with the ability of artificial intelligence tools to help reproduce and exploit them, could trigger a wave of cyberattacks against unpatched systems.
PHP, a programming language first developed in the early 1990s, powers websites and is widely used by content management systems and online platforms including WordPress, Drupal, Joomla, and Magento. Its extensive use means that vulnerabilities can have far-reaching consequences.
Cybersecurity agencies urged website operators to install the fixes as soon as possible or take affected websites offline until they could be secured.
Data from internet intelligence firm Censys indicated that around 1.5 million of the 2.6 million hosts it identified were running PHP versions for which no fix was available.
The Dutch National Cyber Security Centre temporarily took its own website offline as a precaution. The operator of Wikipedia also said it had disabled an unspecified number of systems until they could be safely patched, while the Internet Archive briefly went offline to address the issue.
The disruption prompted responses from government leaders. Dutch Prime Minister said he was closely monitoring the situation, while Japanese Prime Minister Sanae Takaichi urged website operators to check whether their sites used PHP and prepare to install the security update.
Two cybersecurity companies said artificial intelligence helped uncover the vulnerabilities.
The White House said it is aware of the vulnerability on Friday, describing its discovery as an example of how American technological innovation could strengthen national security.
PHP is free, open-source software maintained by a community of developers. When a user visits a PHP-powered website, the server processes the relevant code and delivers the resulting page to the browser.
According to web technology tracker W3Techs, PHP is used by roughly 75 per cent of websites whose server-side programming language can be identified.
Automattic, which operates WordPress.com and Tumblr, said its hosted services were protected against the vulnerabilities. The risks were greater for smaller websites managed by individuals or organizations with limited technical resources, particularly those using shared hosting services where customers have little direct control over server maintenance.
In the Netherlands, organizations that temporarily disabled public-facing websites included the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, websites belonging to the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.
In Finland, state IT services provider Valtori said it had taken government public network services offline as a precaution.
France’s Interior Ministry also put all its websites into preventive maintenance while they addressed the vulnerabilities.
Related articles:
The post Governments Take Websites Offline after Critical PHP Security Flaws Disclosed appeared first on Hungarian Conservative.