Websites go dark worldwide after critical flaws are exposed, leaving up to 70% of sites

Government portals, hospital websites and school services went dark worldwide on Wednesday as operators scrambled to protect against two critical software flaws.

The disruptions stemmed from vulnerabilities in PHP, a programming language used to power up to 70 percent of the world’s websites.

Websites and online services have been temporarily taken offline in several countries, including the Netherlands, Finland, France and Denmark, over fears of an attack.

The US National Security Agency (NSA) and FBI advised organizations using PHP to take affected systems offline if they could not immediately install security updates. 

Major US websites and services, including Etsy, Wikipedia and NASA.gov, use PHP-based technology, illustrating the software’s reach across shopping, information and government services.

Cybersecurity agencies in Europe, Australia, Japan and Britain have also urged PHP users to update immediately or take affected websites offline until the fixes can be applied. 

The flaws could allow hackers to take control of affected servers without needing a password or account. A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors.

Cloudflare, which provides internet infrastructure and security services, reported signs of attacks as website operators raced to install the emergency fixes.

The flaws could allow hackers to take control of affected servers without needing a password or account

Cybersecurity company Huntress said in a blog post: ‘PHP is everywhere. It quietly powers WordPress, ​Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under ⁠the hood.’ 

Both flaws involve how PHP handles a server’s memory. One can cause the software to mishandle information when it encounters memory problems, while the other allows it to reuse information from memory that has already been released.    

The extent of the attacks remains unclear, although cybersecurity platform Patchstack said it had received ‘reports of active exploitation.’

The security team that maintains PHP reportedly released patches to fix the problem at 10am ET. 

Website operators now face a race to install the fixes before hackers can use AI to study the updates and work out how to attack systems that remain unprotected.

Thai Duong, chief executive of Calif, the security company that discovered the vulnerabilities, told The Wall Street Journal: ‘Some dude on Twitter could take the patches and run AI against it and post some exploit script.’

He added: ‘All hell will break loose.’

CERT-EU, the European Union’s technical cybersecurity advisory body, said: ‘Organizations should consider isolating internet-facing applications from public networks until a fix is available.’ 

A successful attack could let criminals steal information stored on a server or turn a trusted website into a tool for launching attacks against its visitors

In the Netherlands, several organizations followed the example of the National Cyber Security Center and took public-facing websites offline.

Those included the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country’s five largest political parties and several hospital websites.

Danish municipal IT company Kombit said it shut down several ⁠services, including ​the national school communication platform, a spokesperson told Reuters.

Disruption was even more widespread in Finland, where state IT services provider ​Valtori said government public network services had been taken offline ‘as a precautionary measure.’ 

France’s Interior Ministry said it had temporarily taken local government administrative websites offline while awaiting a security fix.

AI-assisted hacking campaigns, which have proliferated in recent weeks, could magnify the threat, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.

‘The scale is huge,’ Olejnik said. ‘And with AI, exploitation may happen instantly, on a large scale.’ 

PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. 

Rather than target victims individually, attackers could scan ⁠the internet for systems running vulnerable versions of PHP.