European governments pull websites offline over two critical PHP flaws

Government, hospital and university websites across Europe went dark on Wednesday. Operators pulled them offline to guard against two critical flaws in PHP, the programming language that runs a large share of the web. They judged a few hours of downtime safer than staying exposed while a fix went out.

The shutdowns followed a warning from CERT-EU, the EU’s cyber agency. It had told organisations that could not patch in time to take sites offline. PHP’s developers released the fix on Wednesday afternoon, Reuters reported. It covers two PHP security flaws rated 9.2 out of 10 that let an attacker run code on a server without logging in.

A continent pulls the plug

The roll-call was long. In Germany, the federal IT provider ITZBund took several websites offline, a digital ministry spokesperson told Reuters. The spokesperson called it purely preventive, with no known incidents.

France’s Interior Ministry pulled the sites of local prefectures while it waited for the patch. Belgium’s foreign ministry took its websites down after reports of attacks, though the national cyber centre said it had recorded none on Belgian sites.

The Netherlands saw some of the widest disruption. Its national cyber agency took its own site offline, and others followed. They pulled the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the sites of the five largest political parties and numerous hospitals.

Finland’s state IT centre, Valtori, shut the government’s public web services as a precaution. It said it had found no sign of a breach. In Denmark, the municipal IT company Kombit took down several services, including the national school communication platform.

Wikipedia did not escape either. The Wikimedia Foundation said the flaws affected every PHP system it supports. It had taken a number of them down, it added, until they could be safely patched.

Attacks emerging, or not

The agencies did not agree on how much danger sites faced. Dane Knecht, the chief technology officer of Cloudflare, said the company was already seeing early attacks. It was updating its firewall rules as a stopgap, he said. Others struck a more measured note. Belgium’s cyber centre, Finland’s Valtori and Australia’s cyber agency all said they had seen no exploitation.

The US agency CISA did not respond to a request for comment from The Independent.

A target the size of the web

Researchers warned that the real danger lay in scale. PHP runs roughly three-quarters of the websites whose programming language is known, according to the tracker W3Techs. It is also the engine behind WordPress, which powers about 43% of all sites. Rather than pick targets one by one, attackers can scan the whole internet for vulnerable servers.

AI sharpens the threat. The Independent quoted Lukasz Olejnik, a visiting senior research fellow at King’s College London, on how fast attackers could turn the flaws into AI-assisted attacks.

“The scale is huge. And with AI exploitation may happen instantly, on a large scale,” Olejnik said.

The alarm reached beyond Europe. Cyber agencies in Australia, Japan and Britain urged PHP users to patch at once or take sites offline. Britain’s National Cyber Security Centre, part of GCHQ, told owners to pull systems they could not quickly fix, the Telegraph reported. The forum 4chan and several European universities also went dark.

Volunteers maintain PHP, which is free and open source. The programmer Rasmus Lerdorf created it three decades ago, and it has grown into one of the most widely used technologies on the internet. That ubiquity is why two flaws in it could take so much offline at once.

European security teams, who have themselves used AI to find flaws in EU code, have warned that the same tools now let attackers move at a speed defenders struggle to match.