Government websites and online resources belonging to hospitals and other organizations across Europe are being temporarily taken offline due to critical vulnerabilities in PHP, one of the most widely used programming languages for websites. Developers have already released fixes, but website owners need to install the updates as soon as possible and check the security of their servers, Reports SDWSKI.com.
Reuters reported the threat on October 21. According to the news agency, the issue has affected infrastructure in several European countries, and some organizations have chosen to temporarily take their websites offline to reduce the risk of potential cyberattacks.
What Happened
PHP is used to process data on servers and power numerous websites. Popular content management systems, including WordPress, Drupal, and Joomla, run on it.
The discovered vulnerabilities received a score of 9.2 out of 10 under CVSS 4.0, corresponding to a critical severity rating. Under certain conditions, they could allow attackers to execute commands on a server without prior authorization.
A successful attack could potentially provide access to data, allow website files to be modified, or compromise the server. The actual impact depends on the system configuration and the security measures in place.
The scale of the potential problem is particularly significant due to the widespread use of PHP. According to data cited by Reuters, the language is used by approximately 75% of websites whose server-side technology is known. WordPress, in turn, powers approximately 43% of all websites on the internet.
Which websites were taken offline
Following the discovery of the vulnerabilities, organizations in several European countries implemented emergency security measures.
- The Netherlands. Temporarily took several government resources, hospital websites, the football association's website, and political party websites offline.
- Finland. Suspended some government web services.
- France. Temporarily took local government websites offline.
- Germany and Belgium. Temporary outages of certain resources were also reported.
- Wikimedia Foundation. Reported that it was working to address the vulnerabilities and had temporarily disabled some systems until fixes could be deployed.
However, a website being temporarily taken offline does not mean that it has already been hacked. In some cases, organizations explained that they had taken this action to prevent potential attacks.
Are there any confirmed breaches?
At the time of publication, Reuters reported initial attack attempts. However, the Australian cyber agency said it was not aware of these vulnerabilities being actively exploited.
This is an important distinction: the presence of a critical vulnerability means that a system could potentially be attacked, but does not prove that malicious actors have already gained access to it.
Nevertheless, delaying the installation of patches is dangerous. Once vulnerability details have been publicly disclosed, malicious actors may step up their search for vulnerable servers and attempt to use known attack methods.
Why WordPress updates may not be enough
Owners of websites running WordPress should bear in mind that updating the CMS itself and updating PHP are two separate processes.
WordPress may be updated to the latest version while the server continues to run a vulnerable version of PHP. Standard automatic WordPress updates are no substitute for updating server software.
Depending on the type of hosting, PHP is updated through the control panel or by the hosting provider. Website owners should therefore find out which version is running on the server and whether a patch addressing the discovered vulnerabilities has been installed.
Other infrastructure components must also be taken into account, including plugins, server modules, access settings, and security tools.
What website owners should do
The PHP developers have already released fixes. For website owners and server administrators, the key now is not merely to check for updates, but to make sure they are actually installed and working.
Recommended:
- Check the PHP version. Determine which version is running on the server and compare it with the developers' official recommendations.
- Install the fix. Update PHP to a patched version compatible with the applications in use.
- Contact the hosting provider. If the website owner does not manage the server environment independently, they should confirm whether the update has been installed and what protective measures have been implemented.
- Check the server logs. If there is any suspicious activity, review the logs and assess whether there have been any attempts to exploit vulnerabilities.
- Check the website's security. If there are signs of compromise, further investigation will be required, including reviewing files, accounts, and access permissions, as well as changing any potentially affected credentials.
If a fix is not yet available, contact your provider for recommendations on temporary protective measures. Depending on the situation, access to the vulnerable service may need to be restricted or the service temporarily disabled.
Can Cloudflare help?
Using Cloudflare can provide an additional layer of protection through traffic filtering and web application firewall rules. However, Cloudflare alone does not guarantee protection against exploitation of a specific PHP vulnerability.
The available protections depend on the nature of the attack, the service configuration, and whether all relevant traffic passes through Cloudflare. It should therefore not be considered a substitute for updating PHP.
What this means for the internet
The current situation demonstrates how heavily the security of many websites depends on a relatively small number of widely used technologies. A vulnerability in server software can create a shared problem for government agencies, businesses, media outlets, and independent projects.
Temporarily taking a website offline under these circumstances may be a justified precaution, but it is not necessarily the right solution for every site. The required actions depend on the PHP version, server configuration, availability of a fix, and risk assessment.
Website owners should follow the official recommendations of the PHP developers and their hosting provider, rather than relying solely on reports about the scale of the threat.
Main conclusion: The discovery of critical vulnerabilities does not mean that all PHP websites have been compromised or must necessarily be taken offline. However, if a server is running a vulnerable version of PHP, promptly updating it and conducting a security audit should be top priorities.
0 comments
Enter your email and we will send you a one-time code. No passwords, no accounts.
Code sent to
If the email does not arrive in your inbox within a few minutes, check your Spam, Junk or Promotions folder — some mail services may wrongly place automated messages there.