Serious vulnerabilities have been discovered in PHP, the programming language that powers around 70% of websites worldwide. Developers have released emergency security updates, and cybersecurity experts are urging organizations to update vulnerable systems immediately or temporarily take them offline until they are secured.
In response to the issue, governments in several countries, companies, and major online services have temporarily shut down their websites and systems as a precautionary measure.
The vulnerabilities were discovered using artificial intelligence. The PHP security team rated two of them 9.2 out of 10 for severity, highlighting the seriousness of the flaws.
Initially, experts reported that there were no signs of widespread exploitation before the vulnerabilities were disclosed. However, attack attempts were detected later, raising concerns that systems without security updates could become targets for cyberattacks.
Several European countries have also taken precautionary measures. France's Ministry of the Interior temporarily took departmental websites offline, while Germany's federal IT service provider, ITZBund, shut down several government websites. German authorities said the move was a precaution and that no security incidents had been recorded.
Government and public-service websites were also temporarily taken offline in the Netherlands and Finland as authorities worked to secure their systems.
The UK's National Cyber Security Centre has urged organizations using PHP to identify which systems are vulnerable, strengthen monitoring for suspicious activity, and install security updates as soon as possible.
The incident highlights how heavily government institutions and online services depend on software security. When the same technology is used by a large proportion of websites across the internet, a single vulnerability can create problems for numerous organizations at the same time.
Taking websites offline can temporarily reduce the risk, but it also limits citizens' access to government and public services. As a result, organizations must act quickly while checking their systems' security and restoring operations as soon as possible.
Particular attention should be paid to the fact that the vulnerabilities were discovered using artificial intelligence and that attack attempts were subsequently recorded. This shows that identifying a problem is not enough on its own; security updates must also be installed promptly, and suspicious activity must be monitored. The German authorities' statement that no incidents had been recorded applies to their own systems and does not mean the threat has disappeared for others.
