A security problem in PHP: what it means for your website
Two critical weak spots were found in PHP, the software behind about 70% of all websites. Websites built by Driezie Studio that run on it show a temporary maintenance page until the fix is installed.
Because PHP is so widely used, this touches many organisations at once. Here is what happened, in plain words, and why some websites are temporarily offline.
What happened? The makers of PHP found two critical vulnerabilities, each rated 9.2 (CVSS v4.0). A vulnerability is a weak spot that someone with bad intentions could use to get in. The 9.2 is a score from 0 to 10 for how serious it is: everything from 9 up counts as critical. A fix comes out on Wednesday 21 October at 16:00 Dutch time.
Why are websites going offline? These weak spots could let an attacker take over the computer a website runs on, and everything stored on it. To be safe, many organisations took their websites offline until the fix is in, such as MijnOverheid, DigiD, the RIVM and the ANWB.
Is anyone being attacked? Not as far as anyone knows. The Dutch National Cyber Security Centre (NCSC) has not seen any attacks so far. It advises everyone whose websites run on PHP to install the fix as soon as it comes out.
What does this mean for your website? Nothing you need to do. Driezie Studio keeps an eye on this and takes care of every update. A website that is affected shows a temporary maintenance page until the fix is installed, and comes back as soon as it is safe.
Sources: the announcement on php.net and the NU.nl liveblog.