Critical vulnerabilities in commonly used web code spark rush to update systems

Crucial vulnerabilities in a programming language that underpins much of the internet are so severe that European and British authorities have recommended websites temporarily go offline until they can be fixed.

Several websites were temporarily down as of Wednesday morning, citing fear that hackers could take them over. Those include Pinboard, a bookmarking site, and some parts of Wikipedia.

Japanese websites are also voluntarily offline, including systems for daycare centers and video games, the Japanese tech news site ITmedia reported.

The flaws are in the PHP language, which powers how web servers process code.

The security team that maintains PHP announced Wednesday that it would release patches to fix the problem at 10 a.m. ET.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” it said.

It is unclear how badly hackers are exploiting the flaw in the meantime. Patchstack, a cybersecurity platform, said it had received “reports of active exploitation.”

The chief technical officer of Cloudflare, one of the internet’s largest website hosting companies, wrote on X, “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

CERT-EU, the European Union’s technical cybersecurity advisory body, said, “Organisations should consider isolating internet-facing applications from public networks until a fix is available.”

The United Kingdom’s National Cyber Security Centre recommended: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”

The primary U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, did not immediately respond to an email requesting comment.