Cybersecurity officials and some governments have issued warnings about vulnerabilities disclosed this week in a programming language used in more than two-thirds of all websites on the internet.
Developers of the PHP programming language, estimated to be used in around 70 percent of all websites, said on Tuesday that they had identified two critical vulnerabilities while stressing that users should update their sites.
They announced earlier on Wednesday that a new version of the software, fixing the vulnerabilities, is now live.
Huntress, a company that monitors security breaches, warned earlier this week that details of the two vulnerabilities were “leaked online before their coordinated disclosure and before patches were released” and that there had been reports of attacks being carried out. It advised that website owners update quickly.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” Huntress said in a blog post.
“When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”
WordPress, Wikipedia, Etsy, Tumblr, Facebook, and Flickr are among the popular sites that use the language, according to a website that tracks its usage.
Cybersecurity blog KrebsonSecurity wrote that users should “expect to see quite a few websites serving error pages today” and noted that 70 percent of sites will “need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers.”
It’s not clear how the details of the PHP vulnerability were released before the fix went live. But cybersecurity company watchTowr said on X that “we can confirm” that the detail release was real and that people should “take this seriously and apply patches when available.”
Dane Knecht, chief technology officer of Cloudflare, wrote in a post on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.” He also advised people to patch their systems.
On Wednesday, the British government’s National Cyber Security Centre said in a statement that the vulnerability “could allow an attacker to trigger an out-of-memory condition in PHP that results in memory corruption.”
“Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution,” it said, adding that organizations using any version of the scripting language are vulnerable.
In the Netherlands, several organizations followed the example of the National Cyber Security Center and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, its national soccer association, the websites of the country’s five largest political parties, and several hospital websites.
Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform. Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”
France’s Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.
Reuters contributed to this report.
English (US) · 
Turkish (TR) · 