Critical PHP Flaws Trigger Global Web Shutdowns
EU and Australian agencies urge immediate patching as governments and major organisations take websites offline to mitigate severe vulnerabilities.
Sarah Connor
PHP developers are issuing patches for two critical vulnerabilities rated 9.2 on the CVSS severity scale.
Malicious actors are already exploiting these flaws to compromise systems. A successful attack could allow criminals to steal information stored on a server or turn a trusted website into a tool for launching further attacks against its visitors.
A corrective update addressing the issues became available on Wednesday at approximately 1.45pm GMT (2.45pm BST). Cybersecurity agencies in the EU and Australia have urged organisations to prepare for immediate patching or consider taking vulnerable websites offline.
In Finland, state IT services provider Valtori confirmed that government public network services had been taken offline as a precautionary measure. France's Interior Ministry also temporarily took local government administrative websites offline while awaiting a security fix.
Government bodies in Finland and the Netherlands were among those taking sites down as a precautionary step prior to the fix. In the Netherlands, several organisations, including the Port of Rotterdam, government portal Overheid.nl, and the national soccer association KNVB, took public-facing websites offline.
The websites of the country's five largest political parties and several hospitals also went offline. Danish municipal IT company Kombit shut down several services, including the national school communication platform.
Several websites, including Pinboard and parts of Wikipedia, were temporarily down on Wednesday over fears of being hacked. Huntress stated, "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
Dane Knecht warned, "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update." Automattic, the company behind WordPress, stated, "We don't comment on the details of security issues, but our team is prepared and has been working with the PHP security team to ensure a smooth update."
Automatic platform updates will not apply the fix; website owners must update PHP directly at the server level. Website operators now face a race to install the fixes before hackers can use AI to study the updates and work out how to attack sites that remain unprotected.
The scale is huge. And with AI exploitation may happen instantly, on a large scale.
Lukasz Olejnik stated, "The scale is huge. And with AI exploitation may happen instantly, on a large scale."