Government websites in the Netherlands, Finland and other European countries temporarily suspended operations after critical vulnerabilities were discovered in the PHP programming language, Reuters reports.
Amid reports that hackers were exploiting the flaws, public bodies took online resources offline as a precaution.
In the Netherlands, several organisations followed the example of the National Cyber Security Centre and took their public websites offline. They included the Port of Rotterdam, the government portal Overheid.nl, the Royal Dutch Football Association (KNVB), the websites of the country’s five largest political parties, and several hospitals.
Danish municipal IT company Kombit reported shutting down several services, including a national platform for communication between schools.
In Finland, the disruption was more extensive. State IT services provider Valtori said government online services were taken offline “as a precaution”.
France’s Interior Ministry said it had moved all its websites into preventive maintenance.
Japanese cloud provider Sakura Internet on Wednesday suspended one of the functions of a database management device.
The PHP programming language is used to run a significant portion of the internet, including sites on WordPress, Drupal, Joomla and Magento.
The vulnerabilities could threaten not only government portals but also online shops, news outlets and other websites.
Cloudflare said it is seeing the first attacks and is updating firewall rules as a temporary protective measure. At the same time, the company’s chief technology officer, Dane Knecht, stressed that installing the PHP update must remain a priority.
Cybersecurity agencies in Europe, Australia, Japan and the United Kingdom recommended that PHP users update their systems immediately or take sites offline until patches are installed.
The Wordfence plugin warned WordPress site owners that automatic updates will not install this patch. Administrators therefore need to establish who is responsible for updating PHP on the server.
According to officials, the issue may affect all versions of PHP starting from PHP 5. However, developers have not yet specified the full list of vulnerable versions.
Earlier, cybersecurity researchers said the critical PHP vulnerabilities were identified using artificial intelligence. Experts warn that the availability of patches and the ability to quickly reproduce the exploitation mechanism could fuel further cyberattacks.