PHP2Shell Flaws Prompt Same-Day Government Website Shutdowns in Multiple Countries

On the evening of October 21, a wave of site takedowns unfolded across multiple countries. Government agencies in Finland, the Netherlands, France and Germany, together with hospitals, ports and political parties, pulled their websites offline almost simultaneously. According to GeekPark, the Finnish government shut down all of its external web services. The Dutch National Cyber Security Centre took even its own site down, with the Port of Rotterdam, the Dutch Football Association, five political parties and several hospitals following suit. France's Ministry of the Interior temporarily took provincial government sites offline, Germany's federal IT service provider closed multiple sites, and Belgium's Ministry of Foreign Affairs, the Wikimedia Foundation and Nintendo also stopped parts of their services. None of the sites had been hacked. They were shut down on purpose because of two flaws in PHP, a widely used open-source scripting language built for web development. Nearly 70 percent of websites with a detectable back-end run on PHP, according to W3Techs. The pair of flaws, jointly called PHP2Shell, could allow attackers to remotely control an entire server without logging in, and AI found them first. To current public reporting, this is the first time a vulnerability discovered by AI has driven several governments to close their own websites on the same day.

The PHP organization and the FBI's cyber division warned on Wednesday of significant vulnerabilities in the language, and because PHP powers the majority of websites worldwide, government agencies, companies and other organizations were sent into a flurry, ETtech reported. In the United States, the government is working to address and stop potential cybersecurity issues stemming from the flaws that may impact federal agencies and critical infrastructure, a White House official said, adding that organizations using PHP in websites and software platforms could be exposed to cyberattacks. Jay Chaudhry, CEO and founder of Zscaler, said AI has brought a new wave of cybersecurity needs and that all parties require more proactive measures. Public reporting has so far stopped at the warning and response stage, with no indication of attacks actually having occurred.