On Wednesday, 21 October, public institutions in several European countries took their websites offline after two critical vulnerabilities in PHP were disclosed. The language’s developers released a patch in the afternoon, but some services remained offline. The Polish social networking site wykop.pl is also down.
According to Reuters, PHP’s developers reported two critical vulnerabilities on Tuesday and urged users to update immediately once a fix was published. At around 13:45 GMT (15:45 in Poland) on Wednesday, they announced that a new version fixing the flaws was now available. According to unofficial information on X, one of OpenAI’s AI models discovered the security gap.
Which countries and institutions took their websites offline
According to Reuters, which cites reports of hackers exploiting the flaws, some institutions took their sites offline before the patch as a precaution. The Polish Press Agency (PAP) lists government agencies and public institutions in Germany, the Netherlands, Belgium, Finland and France.
- Netherlands: following the example of the National Cyber Security Centre (NCSC), which took its own website offline, the Port of Rotterdam, the government portal Overheid.nl, the KNVB football association, the websites of the five largest political parties and several hospitals also went dark.
- Finland: the state IT service provider Valtori said public government online services had been shut down “as a precautionary measure”.
- France: the Ministry of the Interior said it had temporarily taken local government administrative websites offline until a patch was received.
- Denmark: the municipal IT company Kombit shut down several services, including a nationwide school communication platform, a spokesperson told Reuters.
Scale of the problem
PHP is free, open-source software developed by volunteers that generates web page content on the server side. According to W3Techs, cited by PAP, it is used by about 75 percent of websites whose server-side language can be determined. It also runs WordPress, which underpins around 43 percent of all websites.
Experts quoted by Reuters warn that the flaws could open the way to millions of servers. Attackers do not need to choose their targets, as they can scan the internet for systems running a vulnerable PHP version. Cybersecurity agencies in Europe, the US, Australia and Japan have recommended an immediate update or taking websites offline until a patch is installed (PAP).
The problem may affect all versions, starting from PHP 5, but, as PAP notes, it has not yet been specified which versions are vulnerable. Wordfence, the maker of a security plugin for WordPress, warns that automatic WordPress updates will not solve the issue, because the fix concerns PHP on the server. Website owners should determine who is responsible for updating PHP at their hosting provider.
What this means for readers in Poland
At the time of publication, we had not found any announcement from Polish institutions about taking government websites offline. There is also no information on the consequences of intrusions or on how many sites were actually attacked. Reuters refers to reports of exploitation without a confirmed scale. Meanwhile, many website owners have acted and taken their websites offline until the PHP vulnerability is patched. In Poland, one of the largest social networking sites, Wykop.pl, decided to suspend access until the patch is properly deployed.
For owners of websites and shops on WordPress and other PHP-based systems, the conclusion is practical. Ask your hosting company whether the server already runs a patched PHP version, and if you administer the server yourself, update it promptly where possible. Unfortunately, on many servers, e.g. those using LiteSpeed, a PHP update will not yet be available. Users of foreign public services, such as Dutch or Finnish ones, may encounter temporary outages until institutions restore their sites after updating.
Komentarze