EU and Canadian government websites taken offline over PHP security flaws

Government websites in several European Union countries and in Canada have been taken offline as a precaution because of critical security vulnerabilities in PHP, a programming language widely used to build websites. The move followed an announcement by the PHP Foundation, which maintains the language, that it was releasing a security update to fix two critical flaws.

According to Reuters, the governments of the Netherlands, Denmark, France and Finland took down at least some of their sites. Evan Solomon, Canada's Minister of Artificial Intelligence and Digital Innovation, wrote on X about the decision to go offline temporarily and backed the call for all PHP users to update as soon as possible.

What is known about the flaws

PHP is a programming language for websites and underpins several major publishing platforms, including WordPress and Drupal. News emerged today that PHP's software had contained serious vulnerabilities for years, and that they were uncovered only now because cybersecurity firms used AI tools. Such flaws could allow a hacker to break into a system running PHP and potentially take control of it.

Tiffany Farriss, interim CEO of the Drupal Association, said all servers running any version of PHP released in the past 20 years are vulnerable, and that the issue affects the majority of the Internet.

US response

The main response from the US government so far is a message from the Cybersecurity & Infrastructure Security Agency (CISA) urging organizations to apply the new patch from the PHP Foundation. The White House told Reuters it was made aware of the issue on Friday.

All website operators using PHP are advised to install the latest security update.