Critical PHP flaws trigger worldwide website shutdowns and patch rollout
Researchers at Calif and Wiz disclosed two high‑severity vulnerabilities in the PHP programming language, prompting emergency patches for versions 8.2 through 8.5. Governments and public agencies across Europe and beyond, including Denmark, the United Kingdom, Hungary, France, the Netherlands, Finland and Germany, temporarily took online portals offline while applying the updates. Major platforms such as Wikipedia, the Internet Archive, DeviantArt and several municipal and national sites also went dark as a precaution. Some services, like Berlin's S‑Berlin and Hessen's state portals, have been restored after patching, and authorities say there is no indication that the flaws have been actively exploited.
How this was covered
- Right-leaning outlets covered this 3h later
- Coverage peaked at 13 outlets in a single hour
Why it matters
Unpatched PHP servers could let attackers take control of websites, potentially exposing personal data and disabling essential public services.
How this story developed
- Oct 12 Cyberattack disrupts refrigeration systems at Intermarché and Coopérative U stores
- Oct 12 The attack specifically exploits outdated Danfoss software versions older than version 4.
- Oct 14 Additional reports note that stores of Monoprix, Leclerc and Carrefour also experienced temperature overrides.
- Oct 21 PHP maintainers announced they will release emergency updates for two high-severity flaws, each rated 9.2/10, in just over a day.
- Oct 21 EU’s CERT‑EU recommended that organisations unable to patch consider taking vulnerable sites offline.
- Oct 21 AI tools identified two severe remote-code execution bugs in PHP, forcing governments and companies to pull or patch sites as a fix was rushed out.
- Oct 22 German state portals, including Berlin and Hessen, were restored after applying the emergency PHP patches.
- Oct 22 Emergency patches for PHP 8.x have been released as the vulnerability spreads.
- Oct 22 Additional governments—including Denmark, the United Kingdom, Hungary, France, the Netherlands and Finland—temporarily disabled public websites while applying the PHP patches.
Related stories
15 in this thread