Major PHP flaw triggers global cyber alert, websites offline

Governments and private organizations across Europe temporarily shut down numerous websites and online services on Wednesday (October 21) following the discovery of two critical security vulnerabilities in PHP, the widely used web programming language.

Entities in the Netherlands, Finland, France, and Denmark took precautionary measures to prevent potential cyber attacks after security experts warned that hackers had already begun attempting to exploit the flaws. 

The security gaps were identified with the help of artificial intelligence by researchers at cybersecurity firms Califf and Wiz, who noted that the vulnerabilities had gone undetected for over a decade. Wiz warned that up to 70 per cent of the internet could be exposed, as PHP powers roughly 75 per cent of all websites with identifiable programming languages, including platforms like WordPress, Drupal, and Joomla.

In response, the Netherlands' National Cyber Security Centre, the Port of Rotterdam, government portals in France and Finland, and several UK web pages went offline or restricted access. The US National Security Agency (NSA) and the UK National Cyber Security Centre advised organizations to keep vulnerable systems offline until security patches are fully implemented.

The PHP Foundation released updated patches on Wednesday to fix the flaws. Cyber security agencies, including the Computer Emergency Response Team for the EU (CERT-EU), urged users to upgrade immediately to PHP 8.2 or later, warning that unpatched servers remain susceptible to remote code execution and unauthorized data access.

-EM