Government websites and online services in several countries were taken offline on Wednesday as cybersecurity agencies warned organisations to fix two critical vulnerabilities in PHP, a programming language widely used to run websites.
Finland temporarily shut down its public government web services, while the Netherlands took its national cybersecurity agency’s website offline as a precaution. Parts of Wikipedia also became unavailable after the Wikimedia Foundation temporarily disabled some systems while working to secure them.
The warnings came after developers released security updates for the two flaws on Wednesday. Agencies in the United States, United Kingdom and European Union urged organisations to install the fixes as soon as possible. Those unable to secure their systems were advised to take affected websites offline until the vulnerabilities could be addressed.
The U.S. National Security Agency warned that the flaws could give attackers a way into servers and databases. The UK’s National Cyber Security Centre also urged organisations to identify systems running PHP, apply the updates and watch for signs of suspicious activity.
The vulnerabilities were discovered by cybersecurity researchers using artificial intelligence (AI). OpenAI said it worked with researchers and security companies, including Calif and Wiz, to identify the flaws and help prepare fixes before they were publicly disclosed.
Wiz estimated that roughly 70% of the internet could be affected, although that figure has not been independently verified. PHP is used by many websites and content management systems, including platforms such as WordPress, Drupal and Joomla.
The flaws are particularly concerning because they could allow attackers to run malicious code on vulnerable systems without first logging in. Depending on the system, this could expose files or databases and potentially allow hackers to compromise a server.
Cloudflare Chief Technology Officer Dane Knecht said the company was seeing early signs of attacks and was updating its protections as new methods emerged.
Security experts have warned that organisations need to do more than install the updates. They must also identify every system running PHP, including software and services that may use it in the background, and check for signs that attackers may have gained access before the fixes were applied.
The PHP Foundation released updates for supported versions of the language and urged users to upgrade immediately. Organisations running older versions may need to upgrade to a supported release to receive the necessary security fixes.
PHP runs on web servers to generate pages, process information and communicate with databases. Although visitors generally do not see it working, it supports a large share of websites and online services.
Cybersecurity agencies have urged website operators to apply the fixes promptly and keep monitoring their systems for further updates and signs of compromise.