Critical PHP Flaws Put Millions of Websites at Risk, Prompting Government Sites to Shut Down

Two critical vulnerabilities in the PHP programming language have been identified, allowing attackers to target websites and servers.

PHP runs on a large percentage of websites worldwide and underpins much of the internet. The vulnerabilities can reportedly be exploited to spread malicious code without logging in.

The severity is rated 9.2 out of 10, according to Cert-se, part of FRA, which handles IT incidents in Sweden.

The combination of widespread use and a serious security flaw of course makes this an urgent matter to fix, says Johan Ahlmark, communications officer at FRA.

Update immediately

A security update was released on Wednesday at 4 p.m., and Sweden's National Cybersecurity Center urges all businesses to update their systems immediately or disconnect them from the internet.

It is up to the businesses themselves to decide how to proceed, depending on what they know about their own networks, says Ahlmark.

Several websites for Swedish universities, including Lund and Karlstad, were down on Wednesday.

Malicious code

Alexandre Bartel is a professor and researcher in software engineering and computer security at Umeå University. He also describes the incident as urgent.

The situation has only been known about since yesterday and is still ongoing, so we don't have all the details. But from what we know so far, the vulnerabilities are very critical.

Hackers can inject malicious code, known as malware, into any server to damage, steal or activate sensitive data, or disrupt services, he says.

The danger now is that those responsible will not be able to fix the security gaps in time.

We know from experience that it takes days, weeks and even months to plug this type of vulnerability.

Rapid development

How the security hole arose and how it was discovered are still unclear, according to Bartel.

We still don't know if it was discovered by researchers or with the help of AI. Things are happening fast now, and this could just be the beginning. AI is getting better at identifying vulnerabilities in systems.

However, AI's ability to outsmart computer systems could ultimately benefit companies, he believes.

AI finding bugs before bad guys will make our computer systems more secure.