Europe pulls government sites offline over PHP flaws

Government agencies in the Netherlands, France, Belgium and Finland took websites offline on Oct. 21 after details of two critical flaws in the PHP programming language became public a day before a fix was ready, forcing a continent-wide scramble to protect public services.

PHP runs roughly 70 per cent of websites, NL Times reported, so the shutdowns reached everything from digital identity logins to a national parliament’s site. The Dutch DigiD login system, the MijnOverheid citizen portal and the House of Representatives website were among the precautionary casualties, NL Times said.

PHP volunteers released a fix on Wednesday afternoon, and the PHP Foundation urged users to update as soon as possible, UA.NEWS reported, citing NDTV. Details of the flaws became public on Tuesday, a day before the planned release, which prompted the urgent shutdowns, UA.NEWS said.

In France, local government websites, including a Paris Police Prefecture resource, were unavailable Wednesday afternoon, UA.NEWS reported. The Interior Ministry said the step followed a request from the French national cybersecurity agency. In Belgium, the Foreign Ministry took its websites offline temporarily, while the Belgian Centre for Cybersecurity reported no attacks on Belgian sites. Finland’s Valtori, the state provider of public-sector IT, switched off government web services as a precaution, Euronews reported.

The U.S. National Security Agency urged organizations to install updates immediately or take vulnerable systems out of operation, UA.NEWS reported. It said the flaws “could give attackers direct access to a server’s file system or database” and could “potentially allow them to take control of a web server without a password.” Euronews reported that CERT-EU, the EU institutions’ cyber emergency team, told organizations unable to patch at once to take their websites offline.

The flaws were found independently by the security firm Calif and OpenAI, which privately told PHP developers in August, UA.NEWS reported. The security firm Wiz later reported additional ways to exploit them. Euronews said AI models from OpenAI and Google turned a long-suspected PHP weakness into a working attack, and that OpenAI called it “one of the most impactful” security bugs in recent memory.

By Thursday, most Dutch sites were back, NL Times reported. The public health institute RIVM, the police anonymous tip line Meld Misdaad Anoniem and several local branches of Veilig Thuis, the domestic violence help service, were still down that morning. The suicide prevention service 113 was restored after an extended outage, and its hotline stayed reachable by phone.

There was no evidence of active attacks in the Netherlands, Matthijs van Amelsfort of the Dutch National Cyber Security Centre said on the television program Pauw & De Wit, NL Times reported. He noted a rise in traffic that suggested people were probing websites for weaknesses.

The outages are a reminder that the same software sits behind many Canadian sites too. Canadian organizations that run PHP are not exempt from the risk, and the Canadian Centre for Cyber Security publishes advisories at cyber.gc.ca. We found no Canadian government outage tied to the flaws in the coverage reviewed.

What to watch is how many sites remain unpatched, particularly older installations that no longer receive updates, and whether any attacker moves from probing to active exploitation. Via NL Times, UA.NEWS and Euronews.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.