Global cyber alert: PHP vulnerabilities take websites offline and could affect government services

A number of websites and public services in various countries have been temporarily taken offline as a security measure after two critical vulnerabilities were identified in PHP, a programming language widely used on the internet.

Cybersecurity institutions have urged organizations to install the necessary updates without delay. If this cannot be done immediately, they recommend temporarily disconnecting vulnerable systems from the internet.

The BBC reports that such measures have been taken by the Finnish government’s public services, the website of the Dutch cybersecurity authority, several services of the Dutch Parliament, and websites connected to BBC programs. The Wikimedia Foundation, which is responsible for the online encyclopedia Wikipedia, has also said it is working to resolve the issue and has temporarily shut down some systems to protect them.

The vulnerabilities were discovered by researchers at cybersecurity companies Calif and Wiz, who used artificial intelligence during the discovery process. They say the issues may have gone undetected for more than a decade.

Wiz has estimated that around 70% of the internet may be exposed to the vulnerabilities, but the BBC notes that this figure has not been independently verified.

Cybersecurity authorities in the United Kingdom, the European Union, Australia, Japan and the United States have urged PHP users to apply the security updates.

The UK’s NCSC has advised organizations to consider temporarily taking affected systems offline if an immediate fix cannot be implemented.

The US National Security Agency has issued similar guidance. Meanwhile, the White House has said federal agencies are working with leading artificial intelligence labs to speed up a solution to the problem.

Experts warn that the vulnerabilities could allow attackers to access files or databases on servers. Exploiting them could lead to remote code execution, the installation of malware or disruption to website services.

Dane Knecht, chief technology officer at Cloudflare, said signs of the first attacks had been detected. He said the company is strengthening and updating its defenses to address new ways of exploiting the vulnerabilities.

Specialists emphasize that the response does not end with installing the update. Organizations should identify all systems using PHP, including content management platforms, hosting services and third-party software. They should also check whether systems were compromised before applying the fixes.

PHP is mainly used to build websites and run services on servers. The language is used by well-known platforms, including WordPress, Drupal, Joomla and Magento.

According to CERT-EU, the risk may also affect PHP versions dating back to the PHP 5 series, introduced in 2004. However, security updates have been released only for newer versions, while users of PHP 8.1 or older are advised to upgrade to versions that are still supported.

Authorities are urging organizations to install the updates, follow new security advisories and verify the integrity of their systems before fully restoring them to operation.