A critical PHP vulnerability knocks European and other government websites offline

Several government websites in Europe and elsewhere went offline on Wednesday after critical vulnerabilities were disclosed in PHP, one of the most widely used programming languages on the internet. According to CNBC, website operators rushed to secure their systems. Because PHP is so widespread, the risk could affect a huge number of servers.

PHP's developers announced on Tuesday that they had found two critical vulnerabilities and urged users to update as soon as a fix was released. At around 13:45 GMT on Wednesday, they said a new version fixing the flaws was available. However, there were reports that attackers were already exploiting the flaws to break into websites. Public agencies in the Netherlands and Finland, among others, took their sites down as a precaution before the patch was available.

Why it matters. PHP is a free, open-source language maintained by volunteers. According to W3Techs, it runs on about 75% of websites whose language can be identified, and it powers WordPress, which the article says runs about 43% of all websites. Cybersecurity firm Huntress noted that PHP also powers Drupal, Joomla and Magento, as well as shared hosting platforms, control panels and a great deal of software that does not even advertise that it uses PHP.

Industry response. Dane Knecht, Cloudflare's chief technology officer, said the company was already seeing early attacks and was updating its firewall rules as a stopgap. He stressed that this is only a temporary fix and that PHP must be updated as soon as the patched version is released. Wordfence, the WordPress security plugin, warned that automatic updates would not apply this fix and advised site owners to find out who is responsible for updating PHP on their sites. Automattic, the company behind WordPress.com, said it does not comment on details of security incidents but that its team is working with the PHP security team to help with the update.

Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom urged PHP users to update immediately or take their sites offline until they could apply the patches. Officials were quoted as saying that every version from PHP 5 onward could be affected, although PHP had not yet said which versions are vulnerable.

The AI factor and the risk to small websites. Experts warn that instead of going after specific victims, attackers can scan the internet for systems running vulnerable versions. Lukasz Olejnik, a senior visiting research fellow at King's College London, said AI-assisted hacking campaigns, which have spread widely in recent weeks, could amplify the threat: "The scale is enormous, and with AI, exploitation can happen instantly and at scale." The risk is especially high for small websites run by individuals or by organizations with few resources. These sites are often on shared hosting, where customers do not manage the servers directly, so they may take longer to patch and stay exposed long after a fix is available.

Widespread outages. In the Netherlands, the National Cyber Security Centre took its own site offline as a precaution. It was followed by the Port of Rotterdam, the government portal Overheid.nl, the KNVB football association, the websites of the five largest political parties and several hospitals. Danish municipal IT company Kombit shut down several services, including the national school communication platform. In Finland the disruption was even bigger: state IT provider Valtori took the government's public network services offline. France's Interior Ministry temporarily took down local authorities' administrative websites while it waited for the fix. The US agency CISA did not respond to a request for comment.

In short, the episode shows how fragile it is to depend on a single ubiquitous piece of software. A patch being available does not end the problem, because many websites will be slow to apply it. The article does not describe the technical nature of the vulnerabilities or give their identifiers, so they cannot be specified here.