LOS ANGELES, Oct. 21 (Nationwide Times) — Finland’s government said it was taking all public-facing internet services offline as a precaution against two critical PHP software flaws, while the Dutch cybersecurity agency said it had shut down its own website. The moves came Wednesday, Oct. 21, as cybersecurity agencies urged urgent action.
Government websites in Europe and elsewhere went offline Wednesday amid the security scramble, Reuters reported. Bloomberg reported that Dutch national and local government websites were taken down.
The BBC reported that the website of the Netherlands’ National Institute for Public Health and the Environment was deactivated. The site of the Tweede Kamer, the lower house of the Dutch parliament, also became inaccessible, the BBC reported.
PHP developers announced the two vulnerabilities Tuesday, Oct. 20. PHP, a programming language used across large parts of the internet, urged users to “upgrade as soon as the release is available.”
PHP’s security update rated both flaws 9.2 on the CVSS v4.0 severity scale, where 10 is the highest score. It scheduled patches for 2 p.m. GMT Wednesday.
The European Union Computer Emergency Response Team said the severity ratings “suggest the potential for unauthenticated remote code execution.” That could allow attackers to run malicious code without logging in. The team urged organizations to prepare immediately to patch affected systems and to consider taking affected sites offline if they could not do so.
Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take websites offline until patches could be applied.
Web-hosting provider GoDaddy said the flaws could let attackers execute code remotely on affected servers, potentially leading to data theft, website defacement or full system compromise.
Reuters reported claims that hackers were already exploiting the flaws to break into websites. Those claims were not presented as confirmed attacks on government services.
Officials said versions from PHP 5 onward could be affected, Reuters reported. PHP had not disclosed which versions were vulnerable.
