UK orders dozens of official websites offline after flaw warnings

British government official sites were taken down on Thursday as administrators rushed to safeguard against two critical ​security flaws in PHP, ​a programming language that powers a large share of the internet.

Baroness Lloyd, parliamentary under-secretary of state at the Department for Digital, Culture, Media and Sport, told the House of Lords that decision to protect data had been taken after the flaws emerged. "The principle impact on government digital services has arisen from precautionary measures taken to protect systems while security updates are applied," she said.

"The government continues to monitor the situation closely and work with departments to maintain the security, resilience, and availability of public services."

Government, school and hospital websites across Europe and beyond were taken offline on Wednesday as cybersecurity ⁠agencies across the world warned fixes were needed.

Organisations unable to apply fixes in ⁠time were told to consider taking affected sites offline. PHP's developers said a ​set of new updates fixing two previously identified critical vulnerabilities was available.

Ciaran Martin, a former head of the UK's cyberagency, said the discovery appeared to be the most serious vulnerability discovered for five years.

Show caption: Ciaran Martin, former chief executive officer of the UK's Na…

UNITED KINGDOM

The British public service broadcaster BBC said it had taken down some web portals on Wednesday. The broadcaster also reported several municipalities taking down their web services, including the city of Edinburgh.

GERMANY

A ⁠spokesperson for the German digital ministry said on Wednesday the federal IT service provider ITZBund had taken several websites offline due to the discovery of PHP vulnerabilities. The temporary deactivation was purely preventive and no security incidents were known to have occurred, the spokesperson said.

FRANCE

The Interior Ministry said it ⁠had temporarily taken offline the websites of prefectures, which are local government administrative offices, while awaiting a security fix for ​the PHP framework ⁠they use. It said the move was ‌a precaution pending a patch from the framework's publisher.

BELGIUM

Belgium's foreign ministry said it had temporarily taken its websites offline following reports ​of cyberattacks exploiting the PHP vulnerabilities, although the country's cybersecurity centre said it had not recorded any attacks on Belgian websites.

NETHERLANDS

Many organizations followed the example of the National Cyber Security Centre and preventively took their public-facing sites offline. They included the Port of Rotterdam, government site Overheid.nl, the national football association KNVB, the websites of the five largest political parties and numerous hospital websites across the country.

FINLAND

State IT centre Valtori shut down the government's public web services on Wednesday as "a precautionary measure." Valtori said it had not identified any attempt to exploit the flaws and that the outage was not the result of a data breach.

CZECH REPUBLIC

The Czech government took its website offline on Wednesday at 7 p.m. (1700 GMT) at the recommendation of the country's cyber watchdog to "allow for the implementation of necessary security patches."

"The measure aims to ensure the secure operation of the website. During the shutdown, the site and its content will not be accessible to the public. Services will be restored once the recommended security updates have been applied," the government office said.

Elsewhere

The Wikimedia ​Foundation, which runs online encyclopedia Wikipedia, said it was in the process of addressing security vulnerabilities ‌in the PHP programming language. All foundation-supported systems and ⁠volunteer-run systems that use PHP are affected, the foundation said ​in a statement.

"We have taken down a number of other systems as a precautionary measure until they ​can be safely patched," ‌the foundation added.

INTERNET ARCHIVE

The non-profit digital library took its portal offline on Wednesday due to emergency maintenance and security patches, it said in a ⁠X post. The website is back online.

ORANGE SA

The French telecoms group temporarily suspended access to a number of websites ⁠and applications using the PHP programming language as a precaution. The measure affects websites, services and applications across several subsidiaries and entities.

JAPAN

Japan's Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures, while Japan's National Tax Agency temporarily took down its service.

Several Japanese companies, including brokerage Nomura , lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said ​on Thursday they were also temporarily suspending some internet services as part of emergency measures.