Developers of the PHP programming language announced two critical vulnerabilities on Tuesday and urged users to update their sites as soon as a fix was released. A new version addressing the flaws was made available around 1345 GMT on Wednesday, but with reports that hackers were already exploiting the vulnerabilities to break into websites, several government agencies took sites offline as a precaution.
The Dutch National Cyber Security Center took its own website offline and recommended other organizations do the same. Following its advice, the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country's five largest political parties and several hospital websites went offline. In Finland, state IT services provider Valtori shut down government public network services. France's Interior Ministry said it had temporarily taken local government administrative websites offline.
The vulnerabilities affect PHP, a programming language that powers a vast portion of the internet. PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. It is the engine behind WordPress, which powers about 43% of all websites. Cybersecurity company Huntress noted in a blog post that "PHP is everywhere," quietly powering WordPress, Drupal, Joomla, Magento, shared hosting platforms and control panels.
Dane Knecht, chief technology officer of Cloudflare, said on X that early attacks were emerging and that Cloudflare was updating its firewall rules as a stopgap measure, urging users to patch as soon as possible. Wordfence, a security plugin for WordPress, warned that automatic updates would not apply the fix and advised site owners to identify who is responsible for updating PHP on their systems.
Security experts warned that the widespread reliance on PHP could leave millions of servers exposed. Attackers could scan the internet for vulnerable versions rather than targeting individual victims. Lukasz Olejnik, a visiting senior research fellow at King's College London, said the scale is huge and that AI-assisted hacking campaigns, which have proliferated, could magnify the threat, allowing exploitation to happen instantly and at scale.
Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. Officials said that all PHP versions from PHP 5 onward could be affected. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) did not respond to emails seeking comment.