Critical PHP security flaws have forced government, hospital and school websites in several countries offline as operators race to install emergency updates and prevent hackers taking control of exposed servers.
The vulnerabilities affect PHP, the programming language used by up to 70 per cent of the world’s websites, including services built on WordPress, Drupal, Joomla and Magento.
The US National Security Agency and FBI have advised organisations to take affected systems offline if they cannot apply the security fixes immediately. Cybersecurity agencies in Britain, Europe, Australia and Japan have issued similar warnings.
The flaws could allow attackers to seize control of a server without a password or user account. They could then steal information stored on the system or use a trusted website to launch attacks against its visitors.
Cloudflare, which provides internet infrastructure and security services, reported signs of attacks as website operators worked to protect their systems. The cybersecurity platform Patchstack said it had received “reports of active exploitation”, although the full extent of the attacks remains unclear.
Both vulnerabilities relate to the way PHP manages server memory. One can cause the software to mishandle data when it encounters memory problems, while the other enables information from already released memory to be reused.
Websites taken offline across Europe
Organisations in the Netherlands, Finland, France and Denmark have temporarily withdrawn public-facing services while they await or apply patches.
In the Netherlands, the National Cyber Security Center was among those taking websites offline. The Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country’s five largest political parties and several hospital websites were also affected.
Danish municipal IT company Kombit shut down several services, including the national school communication platform. In Finland, state IT provider Valtori said government public network services had been taken offline “as a precautionary measure”.
France’s Interior Ministry temporarily took local government administrative websites offline while awaiting a security fix.
The European Union’s technical cybersecurity advisory body, CERT-EU, said organisations should consider isolating internet-facing applications from public networks until a fix was available.
PHP’s security team reportedly released patches at 10am Eastern Time. Website operators are now under pressure to install them before attackers can study the updates and develop methods of targeting systems that remain unprotected.
Thai Duong, chief executive of the security company Calif, which discovered the vulnerabilities, said: “Some dude on Twitter could take the patches and run AI against it and post some exploit script.”
He added: “All hell will break loose.”
Lukasz Olejnik, a visiting senior research fellow at King’s College London, said AI-assisted hacking campaigns could increase the speed and scale of attacks. “The scale is huge,” he said. “And with AI, exploitation may happen instantly, on a large scale.”
Rather than targeting individual victims, attackers could scan the internet for servers running vulnerable versions of PHP. The language works by assembling website content on a server when a visitor loads a page, before sending it to their browser.
