Critical Vulnerabilities in Internet’s Backbone Lead to Government Websites Shutdowns Across Europe
Government websites across Europe went offline on Wednesday following the discovery of critical vulnerabilities in a widely used programming language, which prompted site administrators to take immediate protective actions.
Developers of the PHP programming language announced on Tuesday that they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was available. By around 1:45 PM GMT on Wednesday, it was reported that a new version addressing these vulnerabilities had been released, according to Reuters.
In light of reports that hackers were exploiting these weaknesses to breach websites, government agencies in the Netherlands, France, and Finland proactively disabled several websites ahead of the release of the fix.
PHP underpins a significant portion of the internet, raising concerns about the potential vulnerability of numerous websites to attacks.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and many programs that don’t even mention they use PHP behind the scenes,” stated the cybersecurity firm Huntress in a blog post.
Dane Knecht, Chief Technology Officer of Cloudflare, a company specializing in web and cloud security, indicated that attacks were already beginning to occur. Cloudflare also announced updates to its firewall rules as a temporary protective measure.
“We are seeing attacks start to emerge and are updating risk mitigation measures as new attack vectors appear. This is ONLY A TEMPORARY MEASURE. Install the update as soon as PHP releases it,” Knecht noted in a message on the platform X.
Warnings Issued Across Europe, Australia, and Japan
Wordfence, a security plugin that protects WordPress sites, pointed out that all WordPress sites run on servers with PHP installed. The company warned that automatic updates would not include the fix and advised site owners to find out who is responsible for updating PHP on their servers.
Cybersecurity agencies from EU member countries, Australia, Japan, and the UK urged PHP users to immediately install updates or take their sites offline until security patches could be applied. The Dutch cybersecurity agency even suspended its online operations, citing vulnerabilities as the reason for this precautionary measure.
Officials indicated that all PHP versions from PHP 5 onward could be affected, though PHP has yet to disclose which specific versions are vulnerable.
A Critical Software for the Internet
PHP is a programming language used for web functioning. When a visitor accesses a page, a server running PHP assembles the content and sends it to the browser. It is free software with open-source code, maintained by volunteers.
It is also one of the most widely used software programs on the internet. PHP is the foundation of approximately 75% of websites where the programming language can be identified, according to W3Techs, a platform that monitors web technologies. PHP powers WordPress, which accounts for about 43% of all websites, ranging from blogs and small business pages to government portals, online stores, and news sites.
“We do not comment on the specifics of security issues, but our team is prepared and has worked with the PHP security team to ensure a smooth update,” stated Automattic, the company behind WordPress.com.
The Scope is Enormous
Security experts have stated that the vulnerabilities could potentially expose millions of servers, as so many websites rely on the same underlying software. Instead of targeting individual victims, attackers could scan the internet to identify systems running vulnerable versions of PHP.
Lukasz Olejnik, a senior research fellow at King’s College London, noted that the threat could be amplified by AI-assisted hacking campaigns, which have surged in recent weeks.
“The scale is enormous,” Olejnik remarked. “And with the aid of artificial intelligence, exploiting vulnerabilities could occur instantly and on a large scale,” the researcher warned.
Small websites, managed by individuals or organizations with limited technical resources, often via shared hosting services where clients do not manage the underlying servers directly, face particularly high risks. Security experts indicated that updating these sites could take longer, leaving them exposed even after remedies become available.
Widespread Disruptions to Government Services in Europe
In the Netherlands, multiple organizations followed the lead of the National Cyber Security Centre and shut down publicly accessible websites, including the Port of Rotterdam’s site, the government portal Overheid.nl, the national football federation KNVB’s site, the websites of the five largest political parties in the country, and several hospital websites.
The Danish IT company for municipal administrations, Kombit, announced it had shut down several services, including the national school communication platform.
Disruptions were even broader in Finland, where Valtori, the state’s IT service provider, announced that public services on the government network were taken offline “as a precaution.”
The French Interior Ministry reported temporarily disabling administrative websites of local authorities while awaiting a security solution.
The Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. did not respond to emails requesting comment.
In Romania, government websites appeared to be functioning normally at the time of this article’s publication.
