Government websites in Europe and elsewhere went offline on Wednesday after critical vulnerabilities were disclosed in PHP, a widely used programming language. Website operators rushed to protect their systems.
PHP’s developers said on Tuesday that they had found two critical flaws and asked users to update their sites as soon as a fix was released. Reports that hackers were already exploiting the weaknesses led government agencies in the Netherlands and Finland to take their sites down as a precaution.
Why PHP flaws put many websites at risk
PHP sits beneath large parts of the internet, raising fears that a significant number of websites could be exposed to attack. Cybersecurity company Huntress said in a blog post that the language quietly runs WordPress, Drupal, Joomla and Magento sites, shared hosting platforms and control panels, along with much software that never mentions it.
Wordfence, a security plugin that protects WordPress sites, said every WordPress site runs on a server with PHP installed. It warned that automatic updates would not apply the fix and advised site owners to determine who is responsible for updating PHP on their sites.
Stopgap measures and unclear affected versions
Dane Knecht, chief technology officer of web and cloud security firm Cloudflare, said attacks were beginning to emerge. Cloudflare was updating its firewall rules as a temporary measure, he said on X. “This is a STOPGAP only. Patch as soon as PHP releases the update,” he wrote.
Security agencies in Europe, Australia, Japan and Britain told PHP users to upgrade without delay or pull their sites until patches could be installed. The Dutch cybersecurity agency also took its own website offline, citing the vulnerabilities as the reason.
Officials said all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are actually vulnerable.
