PHP security fixes prompt precautionary website shutdowns across Europe
PHP developers released urgent fixes on 21 October as public services in several countries went offline to protect systems while operators worked to patch them.
PHP developers released urgent security fixes on Wednesday, 21 October, as government and other public-facing websites in Europe and elsewhere went offline as a precaution. Operators were working to protect systems using the widely deployed programming language, Reuters reported; the developers urged users to update immediately.
The shutdowns affected services people use for public information and communication. In the Netherlands, Reuters reported that the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, websites for the country's five largest political parties and several hospital websites were among those taken offline.
Which services were taken offline
Denmark's municipal IT company Kombit shut down several services, including a national school communication platform, according to Reuters. Finland's state IT provider Valtori said it took government public-network services offline as a precaution. France's Interior Ministry placed all its websites into preventive maintenance, while Japan's Sakura Internet suspended a database-appliance function.
The Guardian also reported temporary takedowns among government sites in Germany and Belgium. The range of affected services reflects the reach of PHP: Reuters said the language is built into websites using WordPress, Drupal, Joomla and Magento. A vulnerability in widely used software can therefore leave operators with many systems to identify and update.
Patch advice and the risk to unpatched sites
The Guardian reported that the US National Security Agency advised organisations unable to patch immediately to take their PHP systems offline. It said the vulnerability could provide a path to a server's file system or database. The UK's National Cyber Security Centre gave similar advice and urged organisations to check for backdoors installed by attackers.
Security experts warned that attackers could study the publicly released fixes to target systems that had yet to be updated, Reuters reported. Cloudflare chief technology officer Dane Knecht said early attacks were emerging and the company was updating firewall rules as a temporary measure, according to a Reuters report republished by The Straits Times. The scale and outcome of those reported attempts were not established in the accounts.
Alan Woodward, a cybersecurity expert at Surrey University, told The Guardian that PHP's extensive use made the flaw particularly troubling. He said PHP had issued a patch quickly and urged users to install it. Security experts cited by Reuters said smaller sites, including those on shared hosting services where customers do not directly manage servers, could take longer to patch.
Read in depth: Technology
Airbnb to bar hosts from requiring guests to wash dishes or take rubbish off-site
The revised house rules apply to reservations booked from November 20. Hosts can still ask guests to put dishes in the sink and sort rubbish into indoor bins.
Astronomers discover first documented green star 280 light-years away
White dwarf WD J1330+6435 glows chartreuse after planetary debris enriches its atmosphere with sodium, changing how it absorbs light.
Sources and context
- Flaw in PHP computer language leads to shutdown of websites around worldThe Guardian
- Websites go dark as AI exposes critical security flawsReuters, republished by RTÉ
- Government websites go dark as critical coding flaws send shudder across internetReuters, republished by The Straits Times
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.