PHP security flaws forced millions of websites offline

Millions of websites were temporarily taken offline after critical vulnerabilities were found in PHP, the programming language used to build web services. Yle explains what happened and how the flaws are being fixed.

What is PHP?

PHP is a programming language that has been in use for more than 30 years. One of the world’s most widely used website content management systems, WordPress, is built on PHP. The vulnerabilities may have affected as many as 70 per cent of websites worldwide.

Why were websites taken offline?

The flaws stemmed from design errors in PHP’s memory management and error handling. They could give an attacker direct access to server files or a database by damaging a website’s memory, potentially leading to a data breach.

Researchers at cybersecurity companies Calif and Wiz found the vulnerabilities using artificial intelligence. On Wednesday, several cybersecurity agencies, including the US National Security Agency, urged companies and public bodies to temporarily shut down online services as a precaution against possible breaches.

In Finland, the government’s information and communications technology centre Valtori took state online services offline. The oikeus.fi website, maintained in part by the Ministry of Justice, was among those affected. Reuters reported that websites belonging to authorities, schools and hospitals were also temporarily shut down in several European countries. OpenAI described the vulnerabilities as among the most significant cybersecurity problems in recent times.

When will services return?

The vulnerabilities are being fixed through a security update to PHP. The update was released on Wednesday afternoon, and Valtori began installing it at around 6pm. Many services have since been updated and restored, but disruptions continue on some websites.

Valtori director-general Hannu Naumanen estimated that it could take days or even weeks for all government online services to return to normal. The timetable depends on how many systems need more extensive updates and how much testing those updates require.