Critical PHP Flaws Prompt Warnings to Update or Take Websites Offline
UK, EU and Australian cyber agencies urge immediate fixes as Dutch government websites go dark
By AXY Tech Desk ·
Key points
- Two critical vulnerabilities have been identified in PHP, a programming language widely used across the internet.
- The PHP Foundation is issuing updates to address the flaws on Wednesday afternoon.
- The UK's NCSC, EU and Australian agencies urged users to apply fixes as soon as they are available, or take systems offline.
- Several Dutch government websites, including the Tweede Kamer's, have been taken down or made inaccessible.
- CERT-EU said the risk scores indicate the potential for unauthenticated remote code execution.
Organisations that rely on PHP, a programming language used across much of the internet, were told on Wednesday to install a significant software update today or consider taking their websites offline. Two critical vulnerabilities have been identified in the language, and The PHP Foundation, the group that supports it, is issuing updates to address them on Wednesday afternoon.
The warning is urgent because the flaws are rated as serious. The UK's National Cyber Security Centre (NCSC), along with its counterparts in the EU and Australia, has urged anyone who uses PHP to apply the fixes as soon as they become available. Where a fix cannot be applied straight away, the agency has gone further. In a note, the NCSC said: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
What the warning says
The core message from cyber agencies is simple. Find every system that runs PHP, install the update when it appears, and if that is not possible quickly, switch the affected system off until it can be secured. The BBC's report said the Dutch cyber-security agency is taking its own website offline because of the vulnerabilities. A separate Dutch government body, the National Institute for Public Health and the Environment, has also taken its website down. The website of the Tweede Kamer, the lower house of the Dutch parliament, has become inaccessible.
EU cyber-security officials have issued a similar warning. The European Union Computer Emergency Response Team (CERT-EU) said the risk scores given to the vulnerabilities “indicate the potential for unauthenticated remote code execution.” That phrase carries most of the weight in this story, and it is worth unpacking.
Why PHP touches so many websites
PHP is a server-side scripting language. In plain terms, it is code that runs on the computer that hosts a website, before the finished page is sent to a visitor's browser. It has been around since the mid-1990s and has become one of the most common tools for building websites, especially those that need to pull information from a database, such as a store's product list or a news site's archive.
Most people never see PHP directly, and that is part of the problem. Cybersecurity company Huntress described how deeply it runs through the web. “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood,” the company said.
That matters for small businesses and individuals as much as for large organisations. WordPress, Drupal, Joomla and Magento are content management systems, the software that lets people build and run websites without writing everything from scratch. A shop owner, a local club or a blogger may be running one of these systems on a hosting plan they bought years ago and rarely think about. If the PHP layer underneath is vulnerable, the site owner may not even know it.
What remote code execution could mean
The phrase “remote code execution” describes a specific and serious kind of weakness. It means an attacker who has no login details could, in principle, send instructions over the internet that a vulnerable server then carries out as if they were trusted commands. Once that happens, the attacker is no longer just looking at a website. They are running their own programs on the machine that hosts it.
The BBC's report said that such a cyber-attack could potentially allow hackers to install malware and take down websites. Malware is malicious software, and it can be used to steal data, insert hidden content, or use a server for other attacks. Taking a site down is the most visible outcome, but the less obvious risks can last longer, because an intruder who gets in quietly may stay for weeks.
The word “unauthenticated” in the CERT-EU statement is also important. It means the attacker does not need to prove who they are first. That lowers the barrier for attackers, and it is why agencies are treating the matter as urgent rather than as a routine patch to schedule for next month.
How governments are responding
The speed of the official response stands out. The NCSC, its counterparts in the EU and Australia, and several Dutch public bodies have all acted within the same news cycle. Taking government websites offline is a visible step. It signals that the agencies see the risk as real enough to accept the inconvenience of public services being unavailable.
The decision to shut down public sites also shows the trade-off that agencies are making. A website that is offline can frustrate residents, but a compromised government website could spread malicious content to visitors or expose information held on the server. Agencies appear to have judged that a short outage is the lesser harm while fixes are applied.
The PHP Foundation is handling the technical side of the response. Its updates are due on Wednesday afternoon, and the agencies have asked users to apply them as soon as they become available, rather than waiting for a routine maintenance window.
What website operators should do
For people who run websites, the practical steps are clear, even if carrying them out can be difficult. The first task is to find out whether PHP is in use. For many people that means checking with their hosting provider or looking at the software stack behind a content management system. Shared hosting customers may need to ask their provider directly, because they often cannot update PHP themselves.
Second, install the update as soon as it is available, and check that the update has actually been applied. A system can be running an older version even after an update is announced, so it is worth confirming the version in use. Third, if a fix cannot be installed quickly, the agencies' advice is to take the affected system offline until it can be fully protected. That is a blunt tool, but it is the one the NCSC has recommended in writing.
Analysts and security teams generally advise checking logs for unusual activity after a serious flaw is disclosed, particularly if a site was exposed before it was patched. Any sign of unexpected files, new administrator accounts or strange outgoing traffic should be treated as a reason to investigate further.
What to watch next
Several questions remain open. The source material does not say how many websites are running vulnerable versions of PHP, nor how many have already been affected. It also does not say whether any attacks have been confirmed in the wild. Those are the facts that would show how urgent the situation is for ordinary website owners, and they may become clearer as the updates are released and tested.
The next signal to watch is whether the Dutch government sites return to normal once their fixes are in place, and whether other public bodies follow the same course. It will also be important to see how quickly hosting providers roll out the PHP updates to their customers, since many sites depend on them rather than on their own servers.
For now, the message from cyber agencies is unusually direct. Install the fix, or switch the system off. For anyone who runs a website built on PHP, the time to check is today.
Questions and answers
What are the PHP vulnerabilities?
Two critical vulnerabilities have been identified in PHP, a programming language widely used across the internet. The source material does not give further technical details about them.
Should website owners take their sites offline?
Cyber agencies in the UK, EU and Australia said organisations should install the fixes as soon as they become available. Where immediate remediation is not feasible, the UK's NCSC said organisations should consider taking the system offline until it can be fully mitigated.
Which websites are affected by the PHP flaws?
PHP quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms and control panels, according to Huntress. The Dutch cyber-security agency, a Dutch public health agency and the Tweede Kamer's website have been taken offline.
When will the PHP fixes be released?
The PHP Foundation is issuing updates to address the vulnerabilities on Wednesday afternoon. Organisations are being told to apply them as soon as they become available.
Topics: PHP, website security, cyber security, NCSC, software vulnerabilities, WordPress, Dutch government
Sources: BBC Technology