Critical PHP Security Vulnerability Takes Down Government Websites Across Multiple European Countries

On October 21, multiple government websites across Europe and other regions were forced offline Wednesday due to newly disclosed critical security vulnerabilities in the widely used PHP programming language, prompting operators to take urgent steps to secure their systems. The PHP development team announced Tuesday that two critical vulnerabilities had been discovered, urging users to update immediately once the patches are released. The PHP team stated Wednesday that a new version patching the flaws has been officially released. However, amid reports that hackers are actively exploiting the vulnerabilities to compromise websites, government agencies in the Netherlands, Finland, and other countries preemptively took some sites offline before the patches were deployed.

PHP is one of the most widely used programming languages on the internet, powering website platforms such as WordPress, Drupal, Joomla, and Magento. According to data from web technology analytics firm W3Techs, approximately 75% of identifiable websites use PHP. WordPress powers approximately 43% of websites globally, encompassing blogs, small business sites, government portals, e-commerce platforms, and news outlets. This security incident has already triggered widespread website outages across multiple European nations. These include the Port of Rotterdam, the government portal Overheid.nl, the Royal Dutch Football Association, websites for the country's five major political parties, and numerous hospital sites, all of which have been temporarily shut down.