EU and Canadian governments take sites offline after critical PHP flaws
European and Canadian governments temporarily disabled websites to mitigate two critical vulnerabilities in PHP, a widely used web programming language. The flaws, undetected for two decades, were identified using AI tools and allow attackers to gain system control. Because PHP powers major platforms like WordPress and Drupal, the issue impacts a significant portion of the internet. Officials urged operators to update immediately to prevent potential breaches.
Key points
- Governments in the Netherlands, Denmark, France, and Finland temporarily took websites offline to prevent exploitation of two critical PHP vulnerabilities.
- Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, confirmed the preventive measure and urged PHP users to update promptly.
- The vulnerabilities affected all PHP versions released in the last 20 years, allowing potential attackers to infiltrate and control systems.
- Tiffany Farriss, interim CEO of the Drupal Association, stated the issue impacts the majority of the internet due to PHP's use in WordPress and Drupal.
- Cybersecurity firms used AI tools to uncover the flaws, which had remained undetected for years before the PHP Foundation issued a security release.
- The US government's response was initially limited to a missive, while other regions adopted a more aggressive takedown strategy.
Government websites across the European Union and Canada were temporarily taken offline as a preventive measure following the discovery of two critical vulnerabilities in PHP, a ubiquitous programming language used for web development. The affected nations include the Netherlands, Denmark, France, and Finland, which opted to pause digital services to mitigate the risk of immediate exploitation. In Canada, Evan Solomon, the Minister of Artificial Intelligence and Digital Innovation, publicly confirmed the decision to go offline, emphasizing the need for swift action among website operators.
The PHP Foundation recently issued a security release to address the flaws, which had remained undetected for approximately 20 years. The vulnerabilities were identified through the application of AI tools by cybersecurity firms, allowing attackers to potentially infiltrate systems running PHP and gain control. Tiffany Farriss, interim CEO of the Drupal Association, highlighted the scale of the impact, noting that because PHP powers major publishing platforms like WordPress and Drupal, the issue affects the majority of the internet.
The incident has prompted a global call for updates, with officials urging organizations to patch their systems immediately. While the US government responded with a formal missive, European and Canadian authorities took a more proactive approach by temporarily disabling services. The widespread reliance on PHP means that even after the initial takedown, a significant portion of the web remains vulnerable until all operators implement the latest security patch.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
