Government websites taken offline worldwide over PHP software flaws
New Zealand's National Cyber Security Centre said it was aware of a website security scare that led to government websites being shut down around the world. The National Cyber Security Centre is the government agency that monitors threats to New Zealand's online systems.
The scare centres on PHP, a programming language used to build websites. PHP underpins WordPress, Drupal, Joomla and Magento sites. Critical vulnerabilities in the language were disclosed, and websites in Europe and elsewhere went offline as a result.
PHP developers released urgent fixes for flaws that had been in their software for years. The flaws were uncovered using AI, and the developers encouraged all users to update immediately. Tiffany Farriss, interim chief executive of the Drupal Association, said all servers running any version of PHP released in the last 20 years would be vulnerable. Censys data showed that about 1.5 million of 2.6 million hosts reported running a PHP version with no available fix.
Government agencies across Europe took sites offline as a precaution. Reuters reported that the Dutch, French, Danish and Finnish governments took websites offline as hackers exploited weaknesses in PHP. The Dutch cybersecurity agency took its own website offline for the same reason.
Tech firms warned that some hackers were already exploiting the PHP flaws. Costin Raiu, co-founder of TLP:Black, said AI was powering a "race to exploit" the flaws. Researchers at the cybersecurity firm Wiz demonstrated how hackers could use the vulnerabilities to seize control of servers without logging in.
The operator of Wikipedia took down an unspecified number of systems until they could be safely patched. The Internet Archive briefly went offline to address the issue.
Japanese Prime Minister Sanae Takaichi posted on X that website owners should check whether their live site uses PHP and prepare to apply the new fix. Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately, or to take their websites offline until patches were applied.
New Zealand's National Cyber Security Centre urged organisations to apply the recommended PHP fix as soon as possible. It also urged them to investigate possible unauthorised access or compromise.
