Critical PHP flaws force government websites down across Europe as urgent update urged
Two critical security vulnerabilities found in PHP, the programming language underpinning countless websites, have triggered a wave of government website shutdowns across Europe. A fix for the flaws was issued on Wednesday afternoon.
Finland has temporarily shut down the government’s public web services. The Netherlands’ cyber-security agency has taken its own website offline, as has the Dutch National Institute for Public Health and the Environment, while the website of the Tweede Kamer, the lower house of the Dutch parliament, is also inaccessible.
Edinburgh council’s website in the UK has become inaccessible too, along with the online pages of several BBC programmes including Doctor Who and The Traitors — although the BBC has not confirmed a link to PHP.
The flaws were discovered by AI. Cyber-security firm Wiz called them the “most severe vulnerabilities ever discovered” by the technology. Researchers at Calif and Wiz used state-of-the-art AI from OpenAI to find them.
OpenAI described the issue in a blog post as “one of the most impactful security issues in recent memory”. According to the researchers, the flaws had gone undetected for more than a decade.
Wiz estimates roughly 70% of the internet is affected, though the BBC has been unable to verify that figure. The White House said federal agencies were assessing potential impacts on government systems and critical infrastructure. Japan’s Prime Minister Sanae Takaichi urged people to check whether their publicly available websites run on PHP.
The UK’s National Cyber Security Centre (NCSC), along with counterparts in the EU and Australia, has urged PHP users to apply the fixes rapidly. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said.
The EU’s Computer Emergency Response Team (CERT-EU) said the risk scores indicate the potential for unauthenticated remote code execution — meaning an attacker could try to take control of a system from afar without logging in.
Cyber-security company Huntress said: “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.”
Don Smith of the Sophos Counter Threat Unit told the BBC the flaws would “likely be a priority target” for hackers. The immediate challenge, he said, was not simply installing a patch but finding and managing every instance where PHP is running.
Smith added it was crucial to look for signs an attacker “might have already gained a foothold”, since the flaws remained unknown for so long.
In the coming days, website operators worldwide will focus on finding every PHP installation in their systems and updating it; until then, many sites may remain temporarily offline.
