Critical PHP Flaws Trigger Global Web Shutdowns

The flaws allow hackers to seize control of affected servers without needing a password or account. Malicious actors are already exploiting these vulnerabilities to compromise systems, potentially risking the personal data of millions.

A corrective update addressing the issues became available on Wednesday at 1.45pm GMT (2.45pm BST). Cybersecurity agencies in the EU and Australia urged organizations to prepare for immediate patching or consider taking vulnerable websites offline.

Government bodies in Finland and the Netherlands took sites down as a precautionary step before the fix. In Finland, state IT services provider Valtori confirmed that government public network services had gone offline as a precautionary measure.

In the Netherlands, several organizations, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country's five largest political parties, and several hospital websites, took public-facing websites offline. France's Interior Ministry also temporarily took local government administrative websites offline while awaiting a security fix.

Danish municipal IT company Kombit shut down several services, including the national school communication platform. Several websites, including Pinboard and parts of Wikipedia, were temporarily down on Wednesday over fears of hacking.

PHP underpins major content management systems including WordPress, Drupal, and Magento. Huntress stated, "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."

Dane Knecht warned, "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update." Automattic, the company behind WordPress, stated, "We don't comment on the details of security issues, but our team is prepared and has been working with the PHP security team to ensure a smooth update."

Automatic platform updates will not apply the fix; website owners must update PHP directly at the server level. All WordPress sites run on a PHP-installed server.

Security firms independently discovered the flaws using artificial intelligence models. Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11; Wiz, a security firm owned by Alphabet's Google, found and reported a second flaw on August 24.

Lukasz Olejnik stated, "The scale is huge. And with AI exploitation may happen instantly, on a large scale." The underlying vulnerabilities found were decades old.

The vulnerability became public on Tuesday. US President Donald Trump announced his administration coordinates with federal agencies to expedite fixes.

European and British authorities recommended websites go offline, while those in Japan are voluntarily going dark. The UK's National Cyber Security Centre gave similar advice.