Websites across the world taken down to protect systems as critical cyber

Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.

Already a member? Log in

Government websites across the world have been taken down after they were exposed to severe security flaws on Wednesday.

Developers behind the PHP programming language, which underpins extensive portions of the internet, discovered two critical security vulnerabilities on Tuesday leaving sites exposed to cyber intrusions.

At 1.45pm they said that a corrective update addressing the issues was available and urged users to update their sites immediately.

Several government bodies in Finland, France, Denmark and the Netherlands took down sites as a precautionary step after reports that the flaws were being exploited by malicious actors.

Danish IT company Kombit said several services had been shut down, including the country’s national school communication platform. In the Netherlands, several hospital websites and platforms for the five major political parties were taken offline.

Some sites are now back up and running.

A spokesperson for the British government told The Times : “Work is already underway across Government to actively identify and patch any potential exposure.”

Organisations across the board, including private, public, large and small, have been advised to follow guidance issued by the NCSC to “understand their exposure and take the necessary actions to safeguard their systems”.

The widespread use of PHP sparked fears that a substantial number of online services and platforms could remain exposed to cyber attacks.

“HP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare NET.N, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.

Cybersecurity agencies in Europe , Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.

Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable.

PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.

It is also among the most widely used software on the internet. PHP runs roughly 75 per cent of websites whose programming language can be identified, according to web technology tracker W3Techs. It is the engine behind WordPress, which powers 43 per cent of all websites, from blogs and small business pages to government portals, online stores and news sites.

Automattic, the company behind WordPress.com, said: "We don't on the details of security issues, but our team is prepared and has been working with the PHP security team to ensure a smooth update."

Security experts said the vulnerabilities could potentially open the door to millions of servers because so many websites rely on the same underlying software. Rather than target victims individually, attackers could scan the internet for systems running vulnerable versions of PHP.

AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King's College London.

"The scale is huge," Olejnik said. "And with AI exploitation may happen instantly, on a large scale."

The risk is particularly acute for small websites run by individuals or organisations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers. Security experts said such sites could take longer to patch and remain exposed well after fixes become available.

In the Netherlands, several organisations followed the example of the National Cyber Security Center and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites the country's five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform, a spokesperson told Reuters.

Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline "as a precautionary measure."

France's Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.

The US cybersecurity agency CISA did not respond to emails seeking .

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies