PHP flaws prompt website operators to take services offline

Website operators took services offline as they worked to protect systems from newly disclosed PHP vulnerabilities that could give hackers control of servers. The New York Post reported that the flaws, known as PHP2Shell, affect PHP, an open-source programming language used behind the scenes on websites, including sites built with WordPress, Drupal and Joomla.

Cloudflare said it detected attacks targeting the vulnerabilities. The New York Post reported that widespread successful breaches had not been confirmed. The distinction is important: attacks aimed at the flaws were detected, but the account did not report confirmed widespread takeovers. The vulnerabilities carry critical severity ratings of 9.2 out of 10.

Researchers at cybersecurity firm Wiz demonstrated that the flaws could allow hackers to take control of servers without logging in, according to the New York Post. The report described the potential consequence as server control, rather than documenting successful access to a particular operator’s systems. It did not identify a confirmed victim of a successful breach.

Government websites in Germany, France, Belgium, Finland and the Netherlands went offline, Reuters reported, according to the New York Post. The impact in the Netherlands also included hospitals, political organizations and the Port of Rotterdam. The account did not provide a count of the affected websites or organizations. PHP developers released emergency security patches.

They warned that temporary safeguards would not fully protect systems that remained vulnerable, the New York Post reported. The account did not specify which operators installed patches or how many services had returned online.

The PHP Foundation acknowledged that signs of an underlying problem had appeared during a 2024 security audit, but the issue remained unresolved amid technical challenges and limited engineering resources. The New York Post reported the audit history alongside the current vulnerabilities; it did not establish that the earlier problem was identical to PHP2Shell.

The article also said Cloudflare estimated nearly 70% of websites use PHP, underscoring how broadly the software is used.