Government Websites Go Offline as Critical PHP Fixes Roll Out

Government websites and other online services across Europe have been taken offline temporarily while operators respond to two critical PHP security flaws. The shutdowns are largely precautionary. They show the immediate public cost of a vulnerability in software that sits beneath many websites, even before any breach is confirmed at an affected service.

Reuters reported on Wednesday that services in Germany, France, the Netherlands and Finland were among those disrupted as administrators assessed exposure and applied emergency fixes. Some school, hospital and other public-facing sites were also affected. The outages should not be read as evidence that all of those sites were hacked. Several authorities explicitly described taking them down as a defensive measure.

The PHP project released patched versions for two vulnerabilities that could allow unauthenticated remote code execution. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators of affected web-facing installations have been urged to update immediately. TechBooky has already covered the patches and the versions administrators need. The new development is how widely the response has interrupted access to everyday services.

When an organisation cannot verify and install a fix quickly, briefly removing a vulnerable system from the internet can reduce its exposure. CERT-EU advised isolating internet-facing applications if immediate patching was not possible. Britain’s National Cyber Security Centre gave similar advice, telling organisations to consider taking systems offline until the risk is fully mitigated.

That decision is disruptive when a website is a route to government information, school communication or healthcare services. But keeping a potentially exposed service online while waiting for a patch can create a different and potentially larger problem. The trade-off is particularly hard for organisations with older applications, shared hosting or a long chain of suppliers that must test changes before deployment.

Reuters said Germany’s federal IT service provider took several websites offline preventively, with a ministry spokesperson saying no related security incidents were known. France temporarily withdrew prefecture websites while awaiting a fix. Finland’s state IT centre also shut public web services as a precaution and said it had not identified an attempt to exploit the flaws or a data breach.

The Netherlands saw a wider range of sites go dark, including government and hospital pages. Belgium’s foreign ministry temporarily withdrew its websites after reports of attacks exploiting the PHP issues, but the country’s cybersecurity centre told Reuters it had not recorded attacks on Belgian websites. Those different statements matter. A warning about possible exploitation is not the same as proof that a particular offline site was compromised.

The Wikimedia Foundation said it was addressing vulnerabilities in systems that use PHP and had taken down some other systems until they could be patched. The incident highlights how a flaw in a common programming language can ripple beyond a single product or provider.

For the public, an unavailable site may simply mean its operator is choosing to protect it while installing and testing a fix. Users should use the organisation’s verified channels for updates rather than assuming a takedown confirms a data leak.

For site owners, the immediate priority is to identify internet-facing PHP installations, confirm who controls the runtime, install a supported fixed version and monitor for suspicious activity. The official PHP notice also warns that exposure depends on how PHP is deployed, so a WordPress or other application update alone should not be mistaken for confirmation that the server’s PHP runtime has been patched. Services should be restored only after the operator has checked that mitigation is in place.