The key facts
- Two critical PHP vulnerabilities prompted governments and companies to temporarily take websites offline
- PHP developers released updates fixing the vulnerabilities
- The former head of the British NCSC called the finding the most serious in five years
British government websites taken offline
British government websites were taken off the network on Thursday, October 22, following warnings about two critical vulnerabilities in PHP — the programming language that powers a significant portion of the internet. Baroness Lloyd, a parliamentary under-secretary at the Department for Digital, Culture, Media and Sport, told the House of Lords that the decision was made to protect data. According to her, the main impact on the government's digital services arose precisely from the precautions taken while security updates were being installed. She added that the government continues to closely monitor the situation and work with departments to keep public services secure and available.
Scale of the problem and expert reaction
On Wednesday, October 21, websites of governments, schools and hospitals across Europe and beyond were taken offline as cyber agencies in various countries warned of the need to install fixes. Organisations that had not managed to apply the patches were advised to consider taking affected sites offline. PHP developers said they had released a set of updates fixing two previously identified critical vulnerabilities. Ciaran Martin, former head of the UK's National Cyber Security Centre (NCSC), said the discovered vulnerability appears to be the most serious of the last five years.
Reactions of European countries
The British broadcasting corporation BBC reported that it took some web portals offline on Wednesday; according to its reporting, a number of municipalities, including the city of Edinburgh, also took their web services offline. In Germany, the federal IT provider ITZBund took several websites off the network; a spokesperson for the digital ministry called the shutdown purely preventive and said no security incidents had been recorded. In France, the interior ministry temporarily took the websites of prefectures offline while awaiting a patch from the publisher of the PHP framework in use. The Belgian foreign ministry took its websites offline after reports of cyberattacks exploiting the vulnerabilities, although the national cyber security centre said it had recorded no attacks on Belgian websites. In the Netherlands, many organisations followed the example of the National Cyber Security Centre: the Port of Rotterdam, the government website Overheid.nl, the football association KNVB, the websites of the five largest political parties and numerous hospitals went offline. In Finland, the state IT centre Valtori took the government's public web services offline on Wednesday as a precaution, noting that no exploitation attempts had been detected and no data leak had occurred. The Czech government took its website offline on Wednesday at 19:00 local time (17:00 GMT) on the recommendation of the national cyber agency in order to install patches.
Shutdowns in the private sector and other regions
The Wikimedia Foundation, which operates Wikipedia, said it was fixing the vulnerabilities across all supported and volunteer-run systems that use PHP, and took a number of systems offline as a precaution. The non-profit digital library Internet Archive took its portal offline on Wednesday for emergency maintenance and patch installation; the site has already returned online. The French telecommunications group Orange SA temporarily suspended access to a number of PHP-based websites and applications in several subsidiaries. In Japan, the finance ministry and the Meteorological Agency partially suspended online services, and the National Tax Agency temporarily took its service offline. A number of Japanese companies, including the broker Nomura, the bank Mitsubishi UFJ Financial Group, the airline ANA and East Japan Railway, announced on Thursday the temporary suspension of parts of their internet services as part of emergency measures.
