Critical vulnerabilities in commonly used web code spark rush to update systems

Crucial vulnerabilities in a programming language that underpins much of the internet is so severe that European and British authorities have recommended websites temporarily go offline until it can be fixed.Several websites were temporarily down as of Wednesday morning, citing fear that hackers could take them over. Those include Pinboard, a bookmarking site, and some parts of Wikipedia. The Japanese tech news site ITmedia reported that Japanese sites are also voluntarily offline, including systems for daycare centers and video games.The flaws are in the PHP language, which powers how web servers process code.The security team that maintains PHP announced Wednesday that it would release patches to fix the problem at 10 a.m. ET.“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” it said.It is unclear how badly hackers are exploiting the flaw in the meantime. Patchstack, a cybersecurity platform, said it had received “reports of active exploitation.” The chief technical officer of Cloudflare, one of the internet’s largest website hosting companies, wrote on X: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”The European Union’s technical cybersecurity advisory body, CERT-EU, said: “Organisations should consider isolating internet-facing applications from public networks until a fix is available.”The U.K.’s National Cyber Security Centre recommended that “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”The primary U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, did not immediately respond to an email requesting comment.