PHP Security Flaws Force Websites Offline

Two critical vulnerabilities in PHP, one of the internet’s most widely used programming languages, have triggered security alerts and forced government agencies and other organizations to take websites offline. Organizations in the Netherlands and Finland are among those taking precautionary measures. Reports of hackers exploiting the flaws have prompted website operators to urgently strengthen their defences.

PHP’s developers disclosed the two critical vulnerabilities on Tuesday. They urged users to update their software as soon as fixes became available. At 7:45 p.m. local time on Wednesday, they announced that a corrected version had been released.

Several organizations had already taken websites offline before the fixes became available. The widespread use of PHP has raised concerns that the vulnerabilities could affect a large number of online services.

PHP Powers Much of the Web

Cybersecurity firm Huntress said in a blog post that PHP is used across the internet. It powers websites built with WordPress, Drupal, Joomla and Magento. It also supports shared hosting platforms, control panels and many other software products that do not explicitly identify themselves as PHP-based.

Dane Knecht, chief technology officer at web and cloud security company Cloudflare, said on X that initial attacks were underway. He added that defensive measures were being updated as new attack methods emerged.

Cloudflare was updating its firewall rules as a temporary protective measure. Knecht stressed that this was only a stopgap. Users should apply the PHP security update as soon as it becomes available.

Automatic Updates May Not Be Enough

Wordfence, a security plugin for WordPress, said every WordPress site runs on a PHP-powered server. It warned that the fix for the PHP vulnerabilities would not be applied automatically through WordPress updates.

Website owners were urged to identify who was responsible for updating PHP. Depending on the hosting arrangement, the task may fall to the hosting provider, server administrator or website’s technical team.

Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom urged PHP users to update their software immediately or apply the relevant security patches. They also recommended taking websites offline until the fixes could be implemented.

The Dutch cybersecurity agency itself went offline as a precaution. It said the decision was made in response to the vulnerabilities.

Widespread Use Raises Security Concerns

Officials said PHP 5 and later versions could be affected. However, PHP had not yet disclosed exactly which versions were vulnerable.

PHP is a server-side programming language used to generate and deliver website content. When visitors open a webpage, a PHP-enabled server processes the content and sends it to their browsers. The software is free and open source, maintained by volunteers.

According to web technology tracker W3Techs, PHP powers about 75% of websites for which the programming language can be identified.

WordPress, meanwhile, runs approximately 43% of all websites, ranging from blogs and small-business pages to government portals, online stores and news sites. PHP is the core technology behind the platform.

Automattic, the company behind WordPress.com, said it does not comment on the details of security issues. However, its team is prepared and working with the PHP security team to help ensure a smooth update process.

The extensive use of PHP means the incident could affect far more than government portals. Website operators now face an urgent need to verify their PHP versions, apply security patches and ensure that appropriate defensive measures are in place.

//DBTech/INM/SME/MVNO//