Critical PHP flaw sends governments scrambling to take websites offline

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in PHP, a programming language that powers large parts of the internet, sent website operators scrambling to protect their systems.

PHP’s developers said on Tuesday they had found two critical vulnerabilities and urged users to update as soon as a fix was released. Around 1345 GMT on Wednesday, they said a new version fixing the flaws was live, The Express Tribune reported, citing Reuters.

With reports that hackers were already exploiting the flaws, government agencies in several countries took sites offline before the fix as a precaution.

Who went offline

• Netherlands: the National Cyber Security Centre took its own site offline; the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the five largest political parties and several hospitals followed
• Finland: state IT provider Valtori took government public network services offline “as a precautionary measure”
• Denmark: municipal IT company Kombit shut several services, including the national school communication platform
• France: the Interior Ministry temporarily took local government administrative websites offline

Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take their websites offline until they could patch. Officials said all versions from PHP 5 onwards could be affected.

Why PHP matters

PHP runs roughly 75 percent of websites whose programming language can be identified, according to web technology tracker W3Techs. It is the engine behind WordPress, which powers about 43 percent of all websites, from blogs and shops to government portals and news sites.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said.

Attacks already under way

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” said Dane Knecht, chief technology officer of Cloudflare, which updated its firewall rules.

Wordfence, a WordPress security plugin, warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their servers.

Security experts said attackers could scan the internet for vulnerable systems rather than target victims one by one. “The scale is huge,” said Lukasz Olejnik of King’s College London. “And with AI, exploitation may happen instantly, on a large scale.”

Small websites on shared hosting, where customers do not manage the underlying servers, are most at risk, experts said, because they may take longer to patch.

What site owners should do

• Update PHP to the newly released version as soon as possible
• Check with your host: on shared hosting, the hosting company usually controls the PHP version
• Do not rely on automatic updates: WordPress auto-updates do not update PHP itself

Why it matters

With WordPress alone powering about 43 percent of all websites, the fix matters to site owners everywhere, including in Pakistan. Anyone who runs a website should check today that their server has been patched. Read our report on the Google Cloud outage that hit UK banks.

This article draws on reporting by The Express Tribune, Reuters and Geo News.