Critical PHP flaws knock government websites offline across Europe
Why it matters: PHP runs much of the web, and officials warned affected sites to patch immediately or go dark as attacks emerged.
Government websites in Europe and elsewhere went offline Wednesday after developers disclosed two critical PHP vulnerabilities that security officials said could let attackers run commands on exposed servers without logging in. Agencies in the Netherlands and Finland were among those that pulled sites as a precaution, and cyber authorities in Europe, Australia, Japan and Britain urged users to update PHP immediately or disconnect affected services until patches are applied. PHP powers WordPress and other widely used web software, and W3Techs says it runs nearly 70% of websites whose server-side language can be identified. Cloudflare said it was seeing early attacks and updating firewall rules as a temporary measure.