PHP security flaws force website shutdowns as reports of exploitation emerge

Two critical vulnerabilities in PHP, a programming language used to build websites, triggered emergency security updates on October 21. The flaws could enable attackers to take over websites and steal data, according to TechRadar.

The potential reach is unusually large. ABC News described PHP as code vital to an estimated 70% of websites. That figure describes the technology's reach, not a count of websites attacked or taken offline.

PHP also sits beneath popular web design platforms, connecting the risk to online stores, news outlets and government services, NDTV News reported.

On October 21, PHP developers released emergency patches and urged immediate updates, according to Deutsche Welle. TechRadar reported that details had leaked before the patch release, prompting an early security advisory.

Website operators began taking services offline as a precaution. The Guardian reported shutdowns affecting Belgian, Dutch, Finnish, French and German sites. Canadian government websites were also among those offline, according to CBC Top Stories.

The response extended beyond individual website teams. The Defiant reported that the NSA urged PHP users to patch or take systems offline, describing flaws that could let unauthenticated attackers run code on web servers.

By later on October 21, websites were gradually returning after security updates. nu.nl reported the recovery of sites that had been taken offline as a precaution, including government, municipal and hospital websites.

Reporting also raised questions about how the flaws had been handled. The Next Web reported that the PHP Foundation said it had identified one flaw in 2024 but spent months unable to agree on a fix. Separately, The Register reported that PHP developers accused Chainguard of effectively revealing the bugs ahead of the planned disclosure.

On October 22, AI Latest - Wired reported a more serious development: Amazon Web Services had logged exploitation attempts four days earlier, before the patches were released. The outlet said the vulnerabilities were now being broadly exploited across the internet.

Patches are available, and some services are returning. But the recovery reported by nu.nl does not establish that all affected websites are back online or that every exposed installation has been updated.

The distinction between disruption and compromise matters. Many operators shut websites down to keep attackers out, as Mashable Tech reported. The subsequent reporting of exploitation by AI Latest - Wired means the incident is not limited to precautionary outages.

The immediate priority remains deploying the security updates. Deutsche Welle reported that PHP developers were urging immediate action, while The Defiant described advice to take systems offline if they could not be patched.

The next unresolved issue is the extent of compromise before and after the fixes. AI Latest - Wired reported exploitation attempts predating the patches, but the supplied coverage does not establish how many websites were successfully breached.