Government platforms, hospital sites and school services across several countries were taken offline on Wednesday as operators moved to defend against two severe vulnerabilities affecting PHP software.
PHP is one of the internet’s most widely used programming languages, supporting as many as 70 percent of websites worldwide, including services built with WordPress and Slack.
The US National Security Agency and FBI urged organizations running PHP to disconnect vulnerable systems if they were unable to apply the latest security patches immediately.
Online services and websites were shut down in several nations, including the Netherlands, Finland, France and Denmark, while administrators worked to secure their networks.
Cybersecurity authorities in Europe, Australia, Japan and the UK issued similar warnings, telling PHP users to install the updates without delay or temporarily remove exposed websites from the internet.
The security holes could enable attackers to seize control of vulnerable servers without logging in or possessing an authorized account.
If exploited, the flaws could allow criminals to access sensitive server data or compromise legitimate websites and use them to target visitors with further attacks.
Cloudflare, the internet infrastructure and cybersecurity provider, detected indications of attacks while website owners rushed to apply the emergency patches.
The vulnerabilities could give hackers control of exposed servers without requiring a password or user account
Cybersecurity firm Huntress highlighted the far-reaching impact of the vulnerabilities in a blog post, writing: ‘PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.’
The two bugs are linked to PHP’s handling of computer memory. One may cause the language to process data incorrectly during memory errors, while the second can make it reuse information after that memory has already been released.
It was not immediately clear how widespread the attacks were. However, cybersecurity platform Patchstack said it had received ‘reports of active exploitation.’
The team responsible for maintaining PHP reportedly published fixes for the vulnerabilities at 10am ET.
That left website administrators in a race against time to update their systems before attackers could analyze the patches with AI and develop methods for targeting sites that remained exposed.
Thai Duong, chief executive of Calif, the security company that identified the flaws, told The Wall Street Journal: ‘Some dude on Twitter could take the patches and run AI against it and post some exploit script.’
He warned: ‘All hell will break loose.’
CERT-EU, the European Union’s technical cybersecurity advisory organization, advised: ‘Organizations should consider isolating internet-facing applications from public networks until a fix is available.’
Hackers could use a successful breach to take data from servers or hijack trusted websites for attacks on their visitors
In the Netherlands, multiple organizations followed guidance from the National Cyber Security Center by taking their public-facing websites offline.
The affected services included the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, websites belonging to the country’s five largest political parties and several hospital sites.
Danish municipal IT company Kombit said it shut down several services, including the national school communication platform, a spokesperson told Reuters.
Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline ‘as a precautionary measure.’
France’s Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.
AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.
‘The scale is huge,’ Olejnik said. ‘And with AI, exploitation may happen instantly, on a large scale.’
PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.
Rather than target victims individually, attackers could scan the internet for systems running vulnerable versions of PHP.
