Australia edition
Canada edition
France edition
Germany edition
India edition
Italy edition
Japan edition
Korea edition
Netherlands edition
Spain edition
Taiwan edition
U.K. edition
U.S. editionAD reported on Wednesday that several large websites were taken offline after warnings about vulnerabilities in the widely used coding language PHP. In the headline the paper also mentioned sites around DigiD and several hospitals. According to AD, local Dutch authorities and blogs on WordPress, among others, took (part of) their websites offline as a precaution. According to AD and De Telegraaf, Cloudflare saw the first attacks aimed at the vulnerabilities. AD later reported that a security update is available, but that the problems will persist for a while. De Telegraaf wrote that the millions of websites that went dark are slowly coming back online and that PHP spoke of ‘a structural failure’.
PHP runs under a large part of the web, including many management systems. A flaw in the language therefore hits many websites at once, and attackers can automatically search for sites that do not yet have the update. Administrators then face a choice: patch quickly or go offline temporarily.
If you see that a municipal or healthcare website is temporarily unreachable, it may be a precaution. If you manage a site yourself, the available update is what counts. Personal data are only at risk if a site has actually been taken over.
Part of the coverage stresses the risk: AD cites the warning about the danger that sites will be taken over, and Cloudflare had already seen attacks. Going offline is a logical emergency brake in that view, even if it affects ordinary users.
Another note lies in the recovery and the cause: De Telegraaf reports that sites are coming back online and that PHP itself admits the ‘structural failure’. That draws attention to the question of how such a flaw could stay unnoticed for so long.
Confirmed is that many sites went offline as a precaution, that there is an update and that Cloudflare saw first attacks. Not confirmed is how many sites were really taken over. Today, watch for reports on the recovery of DigiD and the hospital websites and for new attacks.
AD (live reports on the PHP vulnerability, Oct 21) · De Telegraaf (Cloudflare and PHP ‘structural failure’, Oct 21)
PHP vulnerability takes millions of websites down, DigiD and hospitals offline too
After warnings about a critical flaw in the coding language, many sites went offline as a precaution on Wednesday; an update is available, but recovery will take time.
Several large websites were taken offline on Wednesday after warnings about vulnerabilities in the widely used coding language PHP, AD reported. In the headline of a live report, the paper wrote that sites around DigiD and several hospitals were also unreachable. According to AD, local Dutch authorities and blogs running on WordPress, among others, took (part of) their websites offline as a precaution. In another report, AD cited the warning that there is a ‘danger that sites will be taken over’. Cloudflare, a cybersecurity company, had already seen the first attacks aimed at the vulnerabilities in PHP, according to AD and De Telegraaf. In the course of the day AD spoke of major cyberattacks worldwide after crucial flaws in the coding language. Other live reports from Dutch media also mentioned the impact across the world, while administrators waited for a crucial update for the affected software.
Later on Wednesday AD reported that a security update is available for the affected websites, but that the problems will persist for a while. De Telegraaf wrote on Wednesday evening that the millions of websites that went dark as a precaution are slowly coming back online. According to the paper, PHP itself admitted fault after the problems and spoke of ‘a structural failure’. De Telegraaf put that statement in the headline of its report on the consequences of the outage for the internet. Which organizations exactly switched off their sites, and how long recovery takes per site, differs per administrator according to the reports. How many websites have actually been taken over has not been confirmed.
Word of the day
PHPTechWidely used programming language on which a large share of websites run.