PHP flaw prompts website shutdowns as agencies rush to patch
Governments and organizations took websites offline after two critical vulnerabilities were disclosed in PHP, a programming language used across much of the web. PHP programmers issued a fix on Wednesday, and security agencies urged organizations to patch affected systems or disconnect them temporarily. The disruption reached public services in several countries, while researchers warned that attackers could exploit vulnerable servers.
Governments and organizations took websites offline after a flaw in the PHP computer language raised concerns about attacks on systems around the world. PHP programmers issued a fix on Wednesday, while security agencies urged organizations that could not install it promptly to disconnect vulnerable sites.
The disruption affected public services in several countries, including Finland, the Netherlands, France and the UK. PHP is used by almost 70% of websites, though the scale of exposure depends on whether a site runs PHP on its own servers.
The consequences were immediate. People could not access some government websites and online services while their operators worked to apply the fix or reduce exposure.
Agencies advise patching or taking sites offline
The vulnerability became public on Tuesday, prompting warnings from national security agencies in Washington and London. The US National Security Agency advised organizations to take systems offline if they could not patch them immediately, saying the flaw could “provide a direct path to the server’s file system or database”.
The UK’s National Cyber Security Centre gave similar guidance and told organizations to check for “backdoors installed by an attacker”. The BBC reported that agencies also urged affected organizations to apply fixes, with some choosing temporary shutdowns.
PHP programmers released a patch on Wednesday. The Wikimedia Foundation said it had taken down several systems as a precaution until they could be safely patched, leaving some users unable to reach parts of Wikipedia.
Sites belonging to councils in Edinburgh, Bristol and Oxford were taken offline in the UK. In France, local government sites including the Paris police prefecture went offline. The Netherlands also took down its national digital identity service, the House of Representatives website and the national cybersecurity centre’s site.
The Australian Signals Directorate was temporarily affected by the outage overnight local time, The Guardian reported. The BBC also reported that Finland temporarily shut down the government’s public web services.
Researchers warn of exploitation window
Prof Alan Woodward, a cybersecurity expert at Surrey University, said the widespread use of PHP made the vulnerability troubling. “The big thing is for everyone using it to get that in to make sure their systems are safe,” he said.
Woodward warned that sites without regular maintenance could remain exposed even after larger organizations apply the patch. “There is this race and some people unfortunately don’t even know they are in the race,” he said.
Michał Woźniak, an internet infrastructure expert, said attackers could automate attempts to exploit the bug. He said vulnerable servers could be used by cryptocurrency miners or by criminal groups and Russian state actors to launch distributed denial of service attacks.
The Guardian reported that the PHP Foundation issued the patch after researchers testing cyber defences found the flaw. OpenAI said it led a coalition of researchers that discovered the vulnerability, while the researcher who found it said they did not use models unavailable to the general public.
For organizations that run PHP, the advice from security agencies is direct: install the fix, or take affected systems offline until they can be secured. Woodward said the risk could persist for “weeks and months of ongoing attacks” if poorly maintained websites remain vulnerable.
