28,000 Danish websites still lack PHP security updates

Some 28,000 Danish websites remain without security updates for vulnerabilities in PHP, the programming language used by websites, online shops and portals, DR reports.

About 8,000 sites can install the update but have not yet done so, said Jeppe Engell, a cybersecurity specialist at the Confederation of Danish Industry. He said the organisation was trying to identify who runs the websites and contact them where possible.

Another 19,000 to 20,000 websites are running such old versions of PHP that they cannot use the security update. Engell said those versions have even more vulnerabilities, making the problems on those sites more extensive. Based on the website names, he believes many of the sites belong to small and medium-sized businesses, but said he could not yet identify the affected organisations.

The vulnerabilities were discovered on Wednesday and had gone unnoticed for years. Artificial intelligence helped uncover them. Websites were taken offline while the security flaws were patched, and public authorities in several countries, including Norway, Finland, the Netherlands, France and Germany, also shut down websites.

Engell said the vulnerabilities are now publicly known and criminals are searching for affected websites. The total number of Danish sites still needing updates was unchanged on Friday from the figure reported on Thursday.