Across Europe, government websites and online resources belonging to hospitals and other organizations are being temporarily taken offline due to critical vulnerabilities in PHP, one of the most widely used programming languages for websites. Developers have already released fixes, but website owners need to install the updates as soon as possible and check the security of their servers.
About the threat reported Reuters on October 21. According to the news agency, the issue affected infrastructure in several European countries, and some organizations chose to temporarily take their websites offline to reduce the risk of potential cyberattacks.
PHP is used to process data on servers and power numerous websites. Popular content management systems, including WordPress, Drupal, and Joomla, run on it.
The discovered vulnerabilities received a score of 9.2 out of 10 on the CVSS 4.0 scale, corresponding to a critical severity rating. Under certain conditions, they may allow attackers to execute commands on the server without prior authorization.
If successfully exploited, this could potentially provide access to data, allow website files to be modified, or compromise the server. The actual impact depends on the system configuration and the security measures in place.
The scale of the potential problem is particularly significant due to the widespread use of PHP. According to data cited by Reuters, the language is used by approximately 75% of websites whose server-side technology is known. WordPress, in turn, powers approximately 43% of all websites on the internet.
Which websites were taken offline
Following the discovery of the vulnerabilities, organizations in several European countries implemented emergency security measures.
- The Netherlands. Temporarily took several government resources, hospital websites, the football association's website, and political party websites offline.
- Finland. Suspended some government web services.
- France. Temporarily took local government websites offline.
- Germany and Belgium. Temporary outages of certain resources were also reported.
- Wikimedia Foundation. Reported that it was working to address the vulnerabilities and had temporarily disabled some systems until patches could be installed.
At the same time, temporarily taking a website offline does not mean it has already been hacked. In some cases, organizations explained that their actions were necessary to prevent potential attacks.
Are there any confirmed cases of hacking?
At the time of publication, Reuters reported initial attack attempts. However, the Australian Cyber Security Centre stated that it was not aware of these vulnerabilities being actively exploited.
This is an important distinction: the presence of a critical vulnerability means that a system is potentially open to attack, but it does not prove that attackers have already gained access to it.
Nevertheless, delaying the installation of patches is dangerous. Once vulnerability details have been publicly disclosed, attackers may step up their search for vulnerable servers and attempt to use known attack methods.
Why WordPress updates may not be enough
Owners of websites running on WordPress should keep in mind that updating the CMS itself and updating PHP are separate processes.
WordPress may be updated to the latest version while the server continues to run a vulnerable version of PHP. Standard automatic WordPress updates are not a substitute for updating server software.
Depending on the type of hosting, PHP is updated through the control panel or by the hosting provider. Website owners should therefore determine which version is running on the server and whether a patch addressing the discovered vulnerabilities has been installed.
Other infrastructure components must also be considered, including plugins, server modules, access settings, and security tools.
What Website Owners Should Do
The PHP developers have already released fixes. For website owners and server administrators, the key now is not just to check for updates, but to make sure they are actually installed and working.
Recommended actions:
- Check the PHP version. Find out which version is running on the server and compare it with the developers' official recommendations.
- Install the fix. Update PHP to a patched version that is compatible with the applications in use.
- Contact the hosting provider. If the website owner does not manage the server environment directly, they should confirm whether the update has been installed and what security measures have been implemented.
- Check the server logs. If suspicious activity is detected, review the logs and assess whether there have been any attempts to exploit vulnerabilities.
- Check the website's security. If there are signs of compromise, further investigation will be required, including reviewing files, accounts, and access permissions, as well as changing any credentials that may have been affected.
If a fix is not yet available, contact your provider for guidance on temporary protective measures. Depending on the situation, access to the vulnerable service may need to be restricted or the service may need to be temporarily disabled.
Can Cloudflare help?
Using Cloudflare can provide an additional layer of protection through traffic filtering and web application firewall rules. However, Cloudflare alone does not guarantee protection against exploitation of a specific PHP vulnerability.
The available protection depends on the nature of the attack, the service configuration, and whether all relevant traffic passes through Cloudflare. It should therefore not be considered a substitute for updating PHP.
What this means for the internet
The current situation highlights how heavily the security of many websites depends on a relatively small number of widely used technologies. A vulnerability in server software can create a widespread problem for government agencies, businesses, media outlets, and independent projects.
Temporarily taking a website offline under these circumstances may be a justified precaution, but it is not necessarily the right solution for every resource. The required actions depend on the PHP version, server configuration, availability of a fix, and risk assessment.
Website owners should follow the official recommendations of the PHP developers and their hosting provider, rather than relying solely on reports about the scale of the threat.
Key takeaway: The discovery of critical vulnerabilities does not mean that all PHP-based websites have been hacked or must be taken offline. However, if a server is running a vulnerable version of PHP, promptly updating it and performing a security audit become top priorities.
If your website is on WordPress, then contact me.
Comments0
Leave a comment
Enter your email—we'll send you a one-time code. No password or registration required.
Your email is only used for the login code and notifications about replies (you can unsubscribe using the link in the email). It is not published or shared with third parties. After you log in, a cookie is stored for 30 days. You can download or delete your data in your account.
Enter the code
Code sent to . If the email doesn't arrive within a few minutes, check your Spam and Promotions folders.
Your name and comment will be displayed publicly. Your email address will not be published.
I want a comment system like this for my website