PHP flaws trigger precautionary outages as operators race to patch
Critical vulnerabilities affect PHP versions 5.4 and later. Governments and organisations took some services offline while applying fixes, but the scale of any exploitation remains unclear.
PHP developers released urgent fixes after two critical vulnerabilities, known as PHP2Shell, were disclosed. The flaws affect PHP versions 5.4 and later and could let attackers run code on websites or access personal information and server credentials.
The reported outages reflect precautionary steps as operators assess exposure and patch systems. Services taken offline or placed under preventive measures included websites in the Netherlands, Finland, France, Belgium and South Korea, as well as some Wikipedia systems. The Internet Archive said it briefly went offline.
The risks span a widely used part of web infrastructure: PHP underpins platforms including WordPress, Drupal, Joomla and Magento. University of Melbourne lecturer Andrew Cullen estimated it powers more than 70 per cent of websites globally, but that figure does not mean those sites were all vulnerable; updated sites are protected.
Calif and Wiz reported the flaws separately in August, and the PHP code had contained them for more than a decade, according to Wiz. Amazon security chief CJ Moses said his team detected an attempted exploit on 17 October, before public disclosure. The supplied reporting does not establish how the attacker learned of the vulnerabilities or whether the attempt succeeded.
Belgium’s cybersecurity centre said it had not recorded attacks on Belgian websites, despite reports that some Belgian sites went offline after reports of attacks. The number of affected systems and any successful intrusions remain unknown. Security agencies, including those in Australia and the EU, urged PHP users to apply the available fixes.
