PHP vulnerability forces European government and company websites offline worldwide

Dozens of Frisian websites were taken offline on Wednesday after critical vulnerabilities were discovered in the PHP programming language. The flaws, which had reportedly remained hidden for years until detected using artificial intelligence, could allow attackers to take control of web servers without a password.

PHP code is used on about 70 percent of all websites, supporting everything from e-commerce to news sites and government services. The Netherlands' National Cyber Security Centre said organisations are themselves responsible for deciding whether to take systems offline.

The centre's director, Corine Schipper-Derkse, said details of the vulnerabilities had leaked before a fix was ready, meaning every minute counted. She warned that some websites might remain offline for some time even after updates are applied.

The United States National Security Agency urged organisations to apply patches immediately or disconnect vulnerable systems. Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom issued similar calls.

PHP developers released two patches ahead of schedule, and the centre expects to publish guidance within an hour of the patch becoming available. No active exploitation had been reported at the time of the Dutch minister's statement.