About 21,300 Danish websites still lack critical PHP security updates, according to new figures from the Confederation of Danish Industry (Dansk Industri, DI) on Friday, 23 October. The number is down from at least 28,000 the previous day, but most of the remaining websites run software too old to use the latest fixes.
DI’s assessment, taken at 10:52 on Friday morning, identified approximately 3,300 websites that could be patched but had not been updated. Another 18,000 websites were running obsolete versions of PHP that cannot use the newly released security updates. The assessment covers only websites with Danish .dk domains, meaning the wider total could be higher.
Why older Danish websites are harder to secure
The figures have changed quickly. Earlier on Friday, DI estimated that about 8,000 websites had yet to install available updates, while 19,000 to 20,000 were running versions too old to be patched, according to Danish broadcaster DR. The new count suggests progress, particularly among sites eligible for the fixes.
DI cybersecurity specialist Jeppe Engell welcomed the reduction but warned that obsolete installations presented a more difficult problem. Their operators will need more extensive upgrades rather than a straightforward security update. Engell said many of the affected websites appeared to belong to small and medium-sized businesses, although DI was still trying to identify their owners.
PHP security updates follow disruptions across Europe
The two critical vulnerabilities were publicly disclosed on Wednesday, 21 October. According to PHP’s development team, they could allow attackers to execute code on vulnerable web servers without first logging in. Security releases are available for PHP versions 8.2, 8.3, 8.4 and 8.5.
Several public websites were temporarily taken offline as a precaution, including Denmark’s Aula school communication platform and Danish Meteorological Institute services. Similar precautionary shutdowns were reported in Norway and Finland. As an Aarhus University explainer stresses, the existence of a vulnerability does not mean it has been successfully exploited.
Denmark has faced several separate cyber incidents
The alert comes after a cyberattack on the Technical University of Denmark and a breach involving the national civil registration system, both of which raised concerns about the security of personal information. Aarhus University also disclosed an intrusion this week, which it said was not connected to the PHP flaws.
No connection has been established between the earlier data breaches and the latest software vulnerabilities. DI’s immediate concern is that thousands of Danish website operators have still not secured their systems.
