PHP 两个未修补严重漏洞引发欧洲多国政府网站预防性下线，补丁当日发布、暂无实质商业化影响

Governments in Europe are taking websites offline in response to warnings about critical security vulnerabilities in a programming language that underpins the internet.

Finland’s government said it was taking offline all public-facing internet services as a precautionary measure. Dutch national and local government websites were also taken down.

The programming language, called PHP, contains two vulnerabilities that have not yet been fixed, which could potentially expose organizations using it in websites and software platforms to cyberattacks.

The UK’s National Cyber Security Centre said in an alert Wednesday that organizations should work to identify any systems running PHP, check them for malicious activity, and consider taking them offline until the vulnerabilities can be mitigated.

The developers responsible for maintaining PHP said that they planned to release security updates on Wednesday at 14:00 UTC.

PHP is one of the web’s most widely deployed technologies, underpinning millions of websites. Any vulnerability could therefore cascade through the internet’s software supply chain, potentially exposing online services to data theft, malware and breaches. Taking sites offline means attackers can’t reach and exploit the flaw while it’s being fixed.

The websites for the Dutch House of Representatives and the National Cyber Security Centre couldn’t be reached as of 2 p.m. local time. Dutch news agency ANP reported more than 100 municipalities, provinces and water boards were affected as they use a service provided by software firm Notubiz. Notubiz counts 254 Dutch local authorities as customers, according to its website.

Notubiz did not immediately respond to a request for comment.

Some universities in Germany and Austria have also pulled their sites, including the University of Vienna and the University of Freiburg.

PHP is “everywhere” and quietly powers websites that run using WordPress, Drupal, Joomla and Magento, according to the cybersecurity firm Huntress. PHP is also present “under the hood” of software, even though the software may not advertise that it is using it, Huntress said.

When there is a critical vulnerability in PHP, Huntress advised in a report on Wednesday, “the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”

Dane Knecht, chief technology officer at cybersecurity firm Cloudflare Inc., said in a post on X that his company had observed some “early attacks” attempting to exploit the vulnerabilities. In response, he said, CloudFlare had introduced protections for customers whose sites were shielded using its technology.