Governments take websites offline as hackers exploit PHP flaws

AMSTERDAM, Netherlands: Government websites and online services across parts of Europe were taken offline on October 21 as authorities rushed to protect systems from critical vulnerabilities in the widely used PHP programming language that hackers had begun exploiting. PHP developers identified two critical vulnerabilities on October 20 and urged users to update their sites once a fix became available. A new version addressing the vulnerabilities went live at around 1345 GMT on October 21. Government agencies in the Netherlands and Finland took websites offline as a precaution ahead of the fix, while cybersecurity agencies in Europe, Australia, Japan and the United Kingdom urged PHP users to update immediately or take sites down until patches could be applied. PHP underpins large parts of the internet. It runs roughly 75 percent of websites whose programming language can be identified, according to web technology tracker W3Techs, and powers WordPress, which runs about 43 percent of all websites. "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said. Cloudflare Chief Technology Officer Dane Knecht said attacks were emerging and the company was updating its firewall rules as a temporary measure. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update," he said on X. Officials have said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable. Security experts said the flaws could potentially expose millions of servers because so many websites rely on the software. Attackers could scan the internet for systems running vulnerable versions rather than targeting individual victims. AI-assisted hacking campaigns could further increase the threat, said Lukasz Olejnik, a visiting senior research fellow at King's College London. "The scale is huge," Olejnik said. "And with AI, exploitation may happen instantly, on a large scale." In the Netherlands, the National Cyber Security Center took its own website offline as a precaution. Other sites taken down included the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the country's five largest political parties and several hospitals. Danish municipal IT company Kombit shut several services, including the national school communication platform. Finland's state IT services provider Valtori said it took government public network services offline "as a precautionary measure," while France's Interior Ministry temporarily took local government administrative websites offline while awaiting a security fix. The U.S. cybersecurity agency CISA did not respond to requests for comment.