Several institutions and organizations in Europe have temporarily disabled their websites after the discovery of two critical security vulnerabilities in PHP, a programming language widely used to power websites and online services.
Among the institutions that have taken action are the Finnish government, Edinburgh City Council and several BBC program websites, including “Doctor Who” and “The Traitors.” In the Netherlands, several official websites have also been disabled, including those of the national cybersecurity agency and the National Institute for Public Health and the Environment.
The vulnerabilities were identified in PHP and an update to fix them was released on Wednesday afternoon. Cybersecurity authorities in the United Kingdom, the European Union, Australia and Japan have urged organizations using the technology to install security updates as soon as possible.
Experts warn that these vulnerabilities could allow hackers to hack into computer systems without having to identify themselves first. This could lead to the installation of malicious programs or the disabling of websites.
The UK's National Cyber Security Centre has advised that organisations that cannot immediately fix the problem should consider temporarily disabling affected systems until they are sure the risk has been eliminated.
Cybersecurity expert Don Smith, from Sophos, told the BBC that these vulnerabilities could become a significant target for attackers. According to him, the challenge is not just installing the update, but also identifying all the systems and programs where PHP is used, as in many cases organizations may not know that the technology is part of their services.
Meanwhile, Cloudflare's chief technology officer, Dane Knecht, announced that signs of the first attacks have been observed and that protective measures are being updated to respond to new attack methods.
It is not yet fully determined which versions of PHP are affected. According to CERT-EU, the vulnerabilities may affect versions from PHP 5 onwards, which was released in 2004.
PHP is used to power many websites, platforms, and online services. Although not all sites rely on this technology, it is one of the most widely used programming languages on the Internet.
Authorities are urging organizations to install the necessary updates and check their systems for possible signs of intrusion, as the risk may persist even after vulnerabilities are fixed.
