Governments take PHP websites offline as critical flaws trigger global warning

Government websites in Europe, Asia and elsewhere have been taken offline as authorities race to patch two critical vulnerabilities in PHP, a programming language used by almost 70% of websites, according to The Guardian. The United States National Security Agency issued an unusually prominent warning on Wednesday, advising organisations using PHP to prepare for an update and to take systems offline if they could not apply it immediately. The agency said the flaws could provide direct access to a server’s file system or database, as reported by The Guardian.

Germany’s digital ministry said it had taken some websites down as a precaution. France deactivated official websites for local administrative offices, while Belgium, the Netherlands, Finland and the Czech Republic also reported temporary shutdowns to apply security patches. In the UK, websites for councils including Edinburgh, Bristol and Oxford were affected, and French sites including that of the Paris police prefecture went offline.

The Netherlands temporarily shut its national digital identity service, the House of Representatives website and the national cybersecurity centre’s site, The Guardian reported. Australia’s Signals Directorate was also temporarily affected overnight, while the Wikimedia Foundation said it had taken several systems down until they could be patched. The vulnerabilities, referred to in the reports as PHP2Shell, involve unauthorised access to parts of computer memory and could allow malicious code to run remotely on servers using old PHP code.

Al Jazeera reported that an attacker would not need a legitimate account or password to exploit the weaknesses. The first flaw was reported by researchers at cybersecurity firm Calif, working with OpenAI, on August 11. Wiz, a cybersecurity company owned by Alphabet, reported the second on August 24.

Wiz described the findings as among the most serious vulnerabilities discovered in PHP and said the underlying weaknesses had existed for decades. There is some difference in the reports over the role of artificial intelligence in the discovery. Al Jazeera said the flaws were found with help from AI models and that AI enabled researchers to test more attack paths.

The Guardian reported OpenAI’s claim that “frontier AI” was key, but also said the researcher who found the weakness had not used models unavailable to the general public. The PHP Foundation issued a patch and urged administrators to update immediately. It said the vulnerabilities were among the most severe it had encountered and warned that AI would make similar weaknesses easier for both attackers and defenders to identify.

Experts cited by The Guardian warned that the immediate patching effort may not end the risk. Internet infrastructure expert Michał Woźniak said automated exploitation, cryptocurrency mining and attacks by organised crime groups or Russian state actors were possible. Professor Alan Woodward of Surrey University said poorly maintained websites could remain exposed for weeks or months, creating a continuing opportunity for attackers.