Critical PHP flaw ‘PHP2Shell' triggers global website shutdowns as fix goes live

A critical set of vulnerabilities in PHP, the programming language powering roughly 70-75% of the web, sparked a global security scramble Wednesday, October 21, forcing government agencies across Europe to take websites offline as developers raced to release a patch.

According to security firm Wiz Research that disclosed the vulnerability, hackers could exploit these bugs and execute remote code and access sensitive information stored in memory on impacted servers including passwords, API keys, and tokens. All PHP versions launched within the last decade from 5.4 are affected by the bugs. The flaws have been identified through two CVEs with a severity of CVSS 9.2.

A patched version was made available for PHP developers around 1345 GMT on Wednesday; however, before the release, several sites went down for safety reasons, including websites of the Dutch national cybersecurity agency, Port of Rotterdam, Dutch government portal, KNVB football association, hospitals and political party sites. 

Finland's state IT provider Valtori also pulled off government services, as did Denmark's Kombit, which shut down the national school communication platform. In France, the Interior Ministry has also taken down administrative sites of the local governments.

Cloudflare CTO Dane Knecht reported that there were already attacks going on, and he is changing firewall rules to address the issue in the interim, saying to "patch as soon as PHP releases the update."

Cybersecurity agencies in Europe, Australia, Japan, and Britain urged immediate updates or taking sites offline.