Critical vulnerabilities found in PHP, powering 70% of the world's websites

Critical security flaws have been discovered in PHP, a widely used programming language that helps power around 70% of the world’s websites.

Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured, Euronews reports.

The warning prompted governments, companies and major online services in several countries to temporarily shut down websites and other systems as a precaution.

The vulnerabilities were uncovered with the help of artificial intelligence. The PHP security team rated both vulnerabilities 9.2 out of 10 for severity. Security researchers initially reported little evidence of widespread exploitation before the vulnerabilities became public. However, attempted attacks have since been detected, increasing concern that unpatched systems could be targeted.

Several European governments have also taken precautionary action.

France’s Interior Ministry temporarily took prefecture websites offline while updates were applied, while Germany’s federal IT provider ITZBund shut down several government websites. German officials said the move was precautionary and that no security incidents had been identified.

Government and public-service websites were also taken offline in countries including the Netherlands and Finland, as authorities worked to secure their systems.

In the UK, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems, monitor them for suspicious activity and install security updates as soon as possible.