A critical coding language vulnerability is taking websites offline over hack fears

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.

Developers ​of the PHP programming language said Tuesday they had identified two critical vulnerabilities, and urged ​users to update their sites as soon as a fix was released. ⁠With reports that hackers were already exploiting the flaws to break into websites, government agencies in ​the Netherlands and Finland were among those that took sites offline as a precaution.

PHP underpins large ​parts of the internet, raising concerns that a significant number of websites could be vulnerable to attack.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful ​lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company ​Huntress said in a blog post.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare (NET.N), said ⁠that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

Wordfence, a security ​plugin that protects WordPress ​websites, said all WordPress ⁠sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who ​is responsible for updating PHP on their sites.

Cybersecurity agencies in Europe, ​Australia, Japan and ⁠Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because ⁠of ​the vulnerabilities.

Officials have said that all PHP versions from PHP ​5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable.