Government portals, hospital websites and school services went offline around the world on Wednesday as operators rushed to defend their systems against two critical software vulnerabilities.
The disruption was linked to flaws in PHP, a programming language used to run as many as 70 percent of websites worldwide.
Services in several countries, including the Netherlands, Finland, France and Denmark, were temporarily taken offline as organizations sought to prevent a potential cyberattack.
The US National Security Agency (NSA) and FBI urged organizations running PHP to take vulnerable systems offline if they could not install the available security updates immediately.
The technology is used by major US websites and services such as Etsy, Wikipedia and NASA.gov, highlighting PHP’s role across online retail, information platforms and government operations.
Cybersecurity agencies in Europe, Australia, Japan and Britain issued similar warnings, telling PHP users to apply the patches without delay or take affected sites offline until they could be secured.
The vulnerabilities could enable hackers to seize control of affected servers without a password or user account. Attackers could then steal data stored on the server or hijack a trusted website to launch attacks against visitors.
Cloudflare, an internet infrastructure and security provider, reported evidence of attacks as website operators worked to deploy the emergency fixes.
The vulnerabilities could allow hackers to control affected servers without a password or account
Cybersecurity firm Huntress wrote in a blog post: ‘PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood.’
Both flaws relate to the way PHP manages server memory. One can cause the software to mishandle data during memory errors, while the other enables it to reuse information after that memory has already been released.
The full scale of the attacks is not yet known, although cybersecurity platform Patchstack said it had received ‘reports of active exploitation.’
The security team responsible for maintaining PHP reportedly issued patches at 10am ET to address the vulnerabilities.
Operators are now racing to install the updates before hackers use AI to analyze the patches and develop methods for attacking systems that remain exposed.
Thai Duong, chief executive of Calif, the security company that discovered the flaws, told The Wall Street Journal: ‘Some dude on Twitter could take the patches and run AI against it and post some exploit script.’
SEE ALSO: Attacker's knife malfunctions as bishop wields cross for protection – NewsFinale
He added: ‘All hell will break loose.’
CERT-EU, the European Union’s technical cybersecurity advisory body, said: ‘Organizations should consider isolating internet-facing applications from public networks until a fix is available.’
Join the discussion
Are you concerned about the security of your personal information?
A successful attack could enable criminals to steal data from a server or use a trusted website to target its visitors
In the Netherlands, several organizations followed the example of the National Cyber Security Center and took public-facing websites offline.
Those included the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit said it shut down several services, including the national school communication platform, a spokesperson told Reuters.
Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline ‘as a precautionary measure.’
France’s Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.
AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.
‘The scale is huge,’ Olejnik said. ‘And with AI, exploitation may happen instantly, on a large scale.’
PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.
Rather than target victims individually, attackers could scan the internet for systems running vulnerable versions of PHP.