Major websites in Europe and the US were temporarily knocked offline Wednesday as operators raced to protect their systems from newly disclosed software vulnerabilities that could give hackers control of servers.
The vulnerabilities, dubbed “PHP2Shell,” affect PHP, an open-source programming language that works behind the scenes to run websites, including those built on WordPress, Drupal and Joomla.
Nearly 70% of websites use PHP, according to cybersecurity firm Cloudflare.
US-based internet forum Something Awful temporarily shut down its message boards, while the Wikimedia Foundation, which operates Wikipedia, disabled supporting services as a precaution.
Germany, France, Belgium, Finland and the Netherlands also took government websites offline, Reuters reported.
Hospitals, political organizations and the Port of Rotterdam were among those affected in the Netherlands.
Cloudflare reported detecting attacks targeting the flaws, although widespread successful breaches have not been confirmed.
Researchers at cybersecurity firm Wiz demonstrated how hackers could exploit the vulnerabilities to seize control of servers without logging in.
The flaws carry critical severity ratings of 9.2 out of 10.
PHP developers released emergency security patches Wednesday, warning that temporary safeguards cannot fully protect vulnerable systems.
The PHP Foundation acknowledged that signs of one underlying problem surfaced during a 2024 security audit but remained unresolved amid technical challenges and limited engineering resources.