PHP Security Flaws Take Government Websites Offline Worldwide: What It Means

Government and organizational websites in several countries went dark this week after two critical security flaws were found in PHP, a programming language used by almost 70% of websites, according to The Guardian. Authorities took sites offline temporarily so they could apply a patch, and security agencies warned that millions of sites will need fixing.

For ordinary users, the most visible effect so far has been outages of public services. The longer-term concern, according to experts quoted by The Guardian, is that poorly maintained sites may stay vulnerable for months.

What it means for people who use affected websites

Outages have hit sites that people rely on for public services. The Guardian reported that in the Netherlands the national digital identity service, the website of the house of representatives and the national cybersecurity center went offline. In France, local government sites, including that of the Paris police prefecture, were taken down. Councils in Edinburgh, Bristol and Oxford in the UK also pulled their websites.

Al Jazeera reported that Germany's digital ministry took some sites offline as a precaution, and that authorities in Belgium, Finland and the Czech Republic said they had also shut down sites to apply the fix. The Australian Signals Directorate was briefly affected overnight, according to The Guardian, and the agency noted that other Australian government sites may have been hit too.

The Wikimedia Foundation said it took several systems down on Wednesday as a precaution until they could be patched. WordPress, Wikipedia and Slack all use PHP, The Guardian noted, as did much of Facebook, at least historically. The sources do not say which services other than those named were disrupted.

What the flaws allow attackers to do

Al Jazeera reported that the two vulnerabilities, nicknamed PHP2Shell, both involve reaching parts of a computer's memory without authorization and using that access to run malicious code. In practice, an attacker could remotely run commands on a server running old PHP code, without a password or a legitimate account.

The U.S. National Security Agency issued a rare public warning. It told organizations that could not patch immediately to take their systems offline, and said the flaw could give attackers a “direct path to the server's file system or database,” according to The Guardian. The UK's National Cyber Security Centre gave similar advice and urged organizations to look for backdoors an attacker might have left behind. Japanese Prime Minister Sanae Takaichi also posted a warning on social media, Al Jazeera reported.

How the flaws were found, and a dispute over AI's role

According to Al Jazeera, researchers at the security firm Calif, working with OpenAI, reported the first flaw on Aug. 11. Wiz, a security firm owned by Alphabet, reported the second on Aug. 24. Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP,” and added that the underlying flaws had existed for decades.

The role of artificial intelligence is contested. The Guardian reported that OpenAI said it led a coalition of researchers and that advanced AI was key to the discovery. The researcher who found the weakness, however, said they did not use any models that were unavailable to the general public.

Why the risk may last for months

PHP is maintained by volunteers, and the nonprofit PHP Foundation said the flaws were among the most severe it has dealt with. It issued a patch on Wednesday and urged anyone who runs a website to update immediately.

Alan Woodward, a cybersecurity professor at the University of Surrey, told The Guardian that many less carefully maintained sites would probably stay vulnerable, which could mean weeks or months of attacks. He described a race between defenders and attackers in which some site owners do not know they are taking part.

Michał Woźniak, an internet infrastructure expert, predicted heavy automated exploitation. He said cryptocurrency miners could take over vulnerable servers at the owners' expense. He also said large criminal groups and Russian state actors could use compromised sites to launch other attacks, including distributed denial-of-service attacks. He argued the episode reflects a long-running habit in the industry of deploying software and never updating it.

What happens next

Sites that were taken down are expected to return as administrators apply the patch, though the sources give no timetable. The PHP Foundation warned that AI will make weaknesses like these easier to find, with reports of new bugs likely to keep growing. It called on technology companies to coordinate their response to avoid major disruptions to online services.

Around Prague, based on reporting by The Guardian, Al Jazeera