Government and Hospital Websites Taken Offline Over Critical PHP Flaws

Government departments, hospitals and other organizations across Europe temporarily took public websites offline on Wednesday while responding to two critical vulnerabilities in PHP. Developers released updates, while security authorities urged organizations that could not mitigate the risks promptly to consider taking affected systems offline.

The outages reflect defensive action as well as concern about exploitation. A website being unavailable does not, by itself, establish that attackers accessed its data.

Public services take preventive action

Germany’s federal IT provider ITZBund disabled several sites, according to a digital-ministry spokesperson quoted by Reuters. The spokesperson described the action as purely preventive and said no security incidents were known.

Finland’s state IT center Valtori also called its web-service shutdown precautionary, saying it had not identified an exploitation attempt and that the outage was not caused by a data breach.

In France, prefecture websites were temporarily disabled while awaiting a fix from their framework publisher. In the Netherlands, affected public-facing sites included Overheid.nl, the Port of Rotterdam and numerous hospitals. The Czech government also announced a temporary shutdown to apply recommended updates.

Patching and reported attacks are separate questions

Belgium’s foreign ministry said it took sites offline following reports of attacks exploiting the vulnerabilities. The country’s cybersecurity center, however, said it had not recorded attacks on Belgian websites. Those statements should not be collapsed into a claim that every disabled site was breached.

The US National Security Agency’s advisory says the flaws can provide a route to a server’s file system or database. It recommends taking a system offline if an immediate update is not feasible, until the risk can be fully mitigated.

The reported hospital impact concerns websites. The cited reports do not establish that medical devices, patient-care systems or patient records were compromised.

Sources

• Reuters: country-by-country shutdown statements
• NSA: official PHP update advisory
• Pexels: license for the server illustration