Critical PHP flaws prompt European and UK calls to take websites offline

Severe vulnerabilities in PHP, the programming language used by about 69% of websites, led many sites to go temporarily offline before patches were released on Wednesday.

Critical vulnerabilities in PHP, a programming language that underpins much of the internet, are so severe that European and British authorities recommended websites temporarily go offline until they can be fixed, NBC News reported.

The security team that maintains PHP, which powers how web servers process code, released patches around 10 a.m. Eastern time on Wednesday.

Several websites, including the bookmarking site Pinboard and some parts of Wikipedia, were temporarily down on Wednesday morning over fears that hackers could take them over. The large forum sites 4chan and Something Awful also went offline to wait for a fix, and Japanese websites, including systems for daycare centers and video games, voluntarily shut down, according to ITmedia.

Web code on a computer screen

PHP is used by 69% of all websites, according to W3Techs. OpenAI, which said it helped discover the flaws, called them “one of the most impactful security issues in recent memory,” adding that they were found through its program giving cybersecurity companies access to models adept at finding software bugs.

The cybersecurity platform Patchstack said it had received reports of active exploitation, while Cloudflare’s chief technology officer said early attacks were emerging and mitigations were being updated.

CERT-EU and the UK’s National Cyber Security Centre advised organizations to consider taking systems offline if they could not be fixed immediately. The U.S. Cybersecurity and Infrastructure Security Agency recommended patching and said it had not observed exploitation as of its advisory.