PHP development team disclosed two severe security vulnerabilities Tuesday and
released a patched version Wednesday after reports of active exploitation,
urging users to update immediately. Operators preemptively took numerous sites
offline to protect systems, including the Port of Rotterdam website, Netherlands
government portal Overheid.nl, the Dutch football association, five major Dutch
party sites and several hospital websites. PHP underpins a large share of the
web (W3Techs: ~75% of sites with identifiable server-side languages use PHP;
~43% of sites run on WordPress), expanding the attack surface for e-government
portals, CMS-driven media, e-commerce platforms and hosted services and raising
the risk of short-term online service disruptions.
