Government websites in the EU and Canada taken offline over PHP vulnerability

One of the two major issues impacting web security this morning has had a ripple effect. In the wake of an announcement from the PHP Foundation that it was issuing a security release to patch two critical vulnerabilities, several government websites in the EU and Canada were taken offline as a preventive measure.

Reuters reported that governments in the Netherlands, Denmark, France and Finland took down at least some websites as a preventive measure. Meanwhile Evan Solomon, Canada's Minister of Artificial Intelligence and Digital Innovation, posted on X about the decision to temporarily go offline, while seconding the call for any website operators using PHP to update as soon as possible.

PHP is a programming language for websites. It's used in several major web publishing services, including WordPress and Drupal. Earlier today, news broke that PHP's software had contained major vulnerabilities for years and they were only just uncovered thanks to AI tools being used by cybersecurity firms. Those flaws could allow a hacker to infiltrate a system running PHP, potentially taking control of it.

"All servers using any version of PHP released in the last 20 years will be vulnerable," said Tiffany Farriss, interim CEO of the ​Drupal Association. "This issue impacts the majority of the Internet."

Thus far, the main response from the US government is a missive from the Cybersecurity & Infrastructure Security Agency encouraging organizations to update to the new patch from the PHP Foundation. In a statement to given to Reuters, the White House said it was made aware of the issue on Friday.