PHP Websites Globally Shut Down Due to Critical Vulnerability

Websites across the globe have gone dark as governments scramble to patch a critical weakness in PHP, a programming language used by nearly 70% of online sites.

The precautionary shutdowns were triggered after experts discovered a vulnerability in the widely-used computer language, which became public on Tuesday. The flaw has left millions of websites at risk of cyber-attacks from bad actors who could exploit it.

Dutch, German, Belgian, Finnish, and French government agencies took down their online services temporarily to prevent potential breaches. This move was prompted by warnings from national security agencies in Washington and London, which highlighted the severity of the PHP vulnerability.

Several high-profile websites that rely on PHP have been affected by the issue, including Wikipedia, Slack, and Wordpress. The Wikimedia Foundation has taken down several systems as a precautionary measure until they can be patched against the flaw.

The PHP Group, the organization behind the language, released a patch to address the weakness after researchers discovered it during testing of cyberdefences.

The discovery of a critical flaw in the PHP computer language has led to widespread shutdowns of websites around the world, prompting urgent warnings from security experts.

In the UK, the National Cyber Security Centre issued an advisory urging organisations to check for "backdoors installed by an attacker", while also highlighting the importance of installing the latest patch to prevent potential attacks. This message echoes the advice being given to PHP users everywhere, who are being told to act quickly to safeguard their systems against exploitation.

Cybersecurity expert Prof Alan Woodward expressed his surprise and concern over the extent of the vulnerability, which affects a language used by countless websites globally. He noted that while PHP has issued a patch, there is still a risk of ongoing attacks targeting less well-maintained sites. These organisations may be unaware they are at risk or may not have the resources to implement the necessary security measures.

The race against time to patch vulnerable systems is already underway, with some websites being taken offline as a precautionary measure. This includes several local government websites in the UK, such as those belonging to Edinburgh, Bristol and Oxford councils, which were shut down due to concerns over potential attacks.

The vulnerability discovered in PHP could lead to exploitation by cryptocurrency miners, who may use vulnerable servers at other people's expense without their knowledge or consent.

Experts warn that large crime organisations and Russian state actors might also utilise these compromised sites as a base for conducting distributed denial of service (DDoS) attacks and other cyber-attacks.

The issue highlights the poor maintenance of internet infrastructure, with underlying vulnerabilities dating back decades, according to Michał Woźniak, an internet infrastructure expert.