Critical PHP Vulnerabilities Prompt Governments and Major Websites to Go Offline

Governments, cybersecurity agencies and major websites are taking systems offline ahead of a planned software update for PHP, the programming language that underpins many online services.

Two critical vulnerabilities have been identified in PHP, which is widely used across the internet. Security fixes are expected to be published on Wednesday afternoon.

Multiple cybersecurity agencies are urging organizations to deploy the updates as soon as they become available. If immediate remediation is not possible, organizations have been advised to consider taking affected websites and systems offline.

Government websites taken offline

Finland has temporarily suspended its government public web services. The Netherlands’ Cybersecurity Agency has also said it would take its website offline because of the vulnerabilities.

The Dutch National Institute for Public Health and the Environment, an agency of the Dutch government, has shut down its website. The website of the Tweede Kamer, the lower house of the Dutch parliament, was also rendered inaccessible.

In the UK, Edinburgh City Council’s website and the online homes of several BBC programmes, including Doctor Who and The Traitors, have become inaccessible.

Those organizations have not confirmed whether the outages are linked to the PHP vulnerabilities. BBC News has asked them for comment.

Cybersecurity agencies urge urgent PHP updates

The UK’s National Cyber Security Centre (NCSC), along with its counterparts in the EU and Australia, is urging organizations that use PHP to apply the fixes as soon as they become available.

“If immediate remediation is not possible, organizations should consider taking systems offline until fully mitigated,” the NCSC said in a memo.

Japan’s National Cybersecurity Secretariat and the EU Cybersecurity Officer have issued a similar warning.

Why the PHP vulnerabilities pose a major risk

PHP is used across websites, content management systems, hosting platforms and other online services.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, Magento sites, shared hosting platforms, control panels, and so much software that doesn’t even advertise that it’s running PHP under the hood,” cybersecurity firm Huntress said.

Don Smith, a cybersecurity expert at Sophos’ threat prevention unit, told the BBC that the vulnerabilities were “likely to be a priority target” for hackers.

The immediate challenge is not simply installing a patch. Organizations must also identify and manage every instance where PHP is running, he said.

“PHP usage is pervasive, exists under public websites, content management systems, hosting platforms, third-party products, and is sometimes transparent to the organizations using it,” Smith said.

He added that organizations should pay close attention to signs that attackers “may already have a foothold.”