On Wednesday, a number of prominent websites across Europe and the US experienced temporary outages as operators scrambled to safeguard their systems from recently revealed software vulnerabilities that could let hackers take control of servers.
The weaknesses, referred to as “PHP2Shell,” affect PHP, an open-source programming language that powers many websites, including those created on platforms like WordPress, Drupal, and Joomla.
According to cybersecurity firm Cloudflare, PHP is utilized by nearly 70% of all websites.
Internet forum Something Awful, based in the US, shut down its message boards for a time, while the Wikimedia Foundation, which manages Wikipedia, disabled some supporting services as a precautionary measure.
In Europe, countries such as Germany, France, Belgium, Finland, and the Netherlands took their government websites offline, as reported by Reuters.
In the Netherlands, various institutions including hospitals, political organizations, and the Port of Rotterdam found themselves affected by these outages.
Cloudflare noted that it had detected attempts to exploit these vulnerabilities, though there have been no confirmed widespread successful breaches.
Cybersecurity researchers from Wiz showcased how these vulnerabilities could allow hackers to gain server control without needing to log in.
These vulnerabilities have received a critical severity rating of 9.2 out of 10.
To address the issue, PHP developers released emergency security patches on Wednesday, but cautioned that these temporary fixes might not completely safeguard all vulnerable systems.
The PHP Foundation acknowledged that signs of a fundamental problem emerged during a security audit back in 2024 but had not been resolved due to technical challenges and limited engineering resources.
