Websites taken offline worldwide due to PHP security vulnerability

Following the release of a software update to patch critical vulnerabilities in the programming language PHP, numerous official and commercial websites worldwide have been temporarily taken offline as a precaution against potential cyberattacks.

Developers of PHP—which forms the foundation of approximately 70 percent of websites, including WordPress and Magento—released updates on Wednesday to address two critical flaws rated 9.2 on the CVSS v4.0 scale. OpenAI, part of the research team that led the effort to resolve the defect, described the situation as one of the most impactful security issues in recent history.

Cybersecurity authorities in the UK, Japan, and the US urged organizations to apply the patches immediately or take systems offline to prevent unauthenticated remote code execution. The UK Office for Budget Responsibility, the French Ministry of Interior, the Czech government, and various municipal service sites in the Netherlands, Denmark, and Finland temporarily shut down their websites as a precaution. Experts warn that the public release of the patch could make it easier for attackers to replicate exploits.