PHP security flaws prompted authorities in Finland, Denmark and the Netherlands to temporarily close government websites and public digital services on Wednesday, 21 October. The closures were precautionary, rather than evidence that the affected institutions had been attacked. Security updates were released later that day, and some services were being restored on Thursday.
The two critical vulnerabilities affect PHP, a programming language widely used to run websites and online services, including WordPress and Drupal. EU cybersecurity authorities warned that the flaws could allow malicious activity on vulnerable servers, including unauthorised access. Swedish broadcaster TV4 reported on the shutdowns on Wednesday.
Finland gradually restores government websites
Finland’s Government ICT Centre (Valtori) took public-facing government services offline as a preventive measure. The National Land Survey website was among those affected, Yle reported. The country’s transport and communications authority, Traficom, also temporarily restricted some services.
On Thursday, Valtori said it was gradually restoring access after installing patches overnight, although some services could take days or weeks to return because of additional testing. The disruption was not caused by a confirmed cyberattack, Reuters reported.
Denmark and the Netherlands also closed services
In Denmark, the websites of Copenhagen Municipality, the Danish Road Directorate and the Danish Meteorological Institute were among those temporarily unavailable. The Aula school communication platform was also taken offline, according to Ritzau. Danish authorities urged website operators to update their systems immediately.
The Dutch government reported precautionary closures involving DigiD, MijnOverheid and Overheid.nl. On Thursday, its National Cyber Security Centre said several sites had returned online and that it had no evidence of successful exploitation of the vulnerabilities.
PHP security flaws have been patched
The PHP development team released security fixes on 21 October for supported versions, including 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The developers urged website administrators to apply updates immediately.
Cloudflare reported millions of attempted attacks following the disclosure, according to Reuters on 22 October. Those attempts do not establish that government websites taken offline were compromised. European cybersecurity authorities advise isolating vulnerable systems until they can be updated.
