Government websites across Europe, Asia and elsewhere have been temporarily taken offline after two critical security vulnerabilities were found in PHP, the programming language used by more than 70% of websites.
The flaws prompted a rare public warning from the United States National Security Agency, which advised organisations to take affected websites offline if they could not be updated immediately.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said in a social media post.
Germany’s Federal Ministry for Digital Transformation and Government Modernisation said it had taken some websites offline as a precaution. France’s Ministry of the Interior deactivated official websites for local administrative offices.
Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said websites had been shut down while a security patch was applied. Japanese Prime Minister Sanae Takaichi issued a warning about the PHP risk on social media.
PHP vulnerabilities described as among the most severe
The two vulnerabilities, known as PHP2Shell, were identified by cybersecurity researchers with the assistance of artificial intelligence models. Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11, while the second was reported by Wiz, a security firm owned by Alphabet, on August 24.
Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”. The company said the underlying weaknesses had existed for decades, but demonstrating that they could be exploited required a chain of steps beyond what human researchers could practically achieve.
Both flaws involve unauthorised access to parts of a computer’s memory, which can then be used to run malicious code. An attacker could remotely run commands on a server using old PHP code over the internet without a password or legitimate account.
The non-profit PHP Foundation, whose volunteers maintain the programming language, said the vulnerabilities were among the most serious it had encountered and urged website administrators to update their code immediately.
It also warned that advances in automated security tools would make weaknesses easier for both defenders and attackers to find. “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said.
