PHP, the language that underpins more than half of the internet, sits at the centre of a cybersecurity crisis that has shaken the world. The flaws, identified with the help of artificial intelligence, allow malicious code to be written without any login. Experts had announced that a patch would be released last night.

International agencies advise going offline

sec1

Warnings that the vulnerabilities could give attackers direct access to a server's file system and database prompted swift action. The NSA, the UK's NCSC, and cyber authorities in Australia and the EU advised organisations unable to apply the patch to take their sites completely offline on a temporary basis.

The US National Security Agency warned every organisation running PHP to be ready for an update that closes the two critical flaws. If patching is not possible, the recommendation is to take systems offline until the problem is fully resolved.

Which sites went dark?

sec2

Germany's Digital Ministry took some public sites offline as a precautionary measure. France's Interior Ministry announced that prefecture websites had been closed to access. In the Netherlands, the National Cyber Security Centre, together with the Port of Rotterdam, Overheid.nl, the football federation KNVB, the five largest political parties and numerous hospital sites, were taken offline.

In Finland, the state IT centre Valtori suspended public web services, while the Czech government shut down its official site on the advice of its cyber security agency. In Turkey, the Cyber Security Directorate issued a nationwide alert.

The Wikimedia Foundation, which runs Wikipedia, took some of its PHP-based systems offline until patches could be applied. In the UK, Edinburgh City Council and BBC pages for shows such as Doctor Who and The Traitors became inaccessible. Japanese Prime Minister Sanae Takaichi called for an urgent review of whether publicly accessible sites use PHP.

Older PHP versions at risk

According to an assessment by CERT-EU, the flaws may reach back as far as PHP 5, released in 2004. The PHP Foundation has published patches only for the most recent versions, meaning systems running PHP 8.1 or earlier need to upgrade urgently.

Dane Knecht, an administrator at Cloudflare, reported that the first attack attempts had been observed and that new layers of protection had been deployed. Attackers are said to be able to run unauthorised remote code and upload malware. No attack has been confirmed so far, but the risk remains, and experts are calling it one of the biggest security vulnerabilities in recent years.