Estonia keeps key public sites open as PHP flaws shut neighbours

Several countries have closed government websites after critical security holes were found in the PHP programming language and developers said they would publish fixes. European Union cybersecurity officials warned that organisations unable to install the updates immediately should temporarily close affected websites. Estonia's Information System Authority (RIA) says it does not currently see a heightened crisis and is not closing important websites.

Veikko Raasuke, an architect at RIA's cybersecurity centre, said Estonia is in relatively good shape on cyber defence and has done extensive work to anticipate problems and protect websites with additional measures. He said protection is currently in place for important state-sector and public-sector sites, and that it was created nine hours before the updates were released publicly. From the standpoint of the state sector and providers of vital services, he said RIA does not see any heightened crisis at present.

Raasuke explained that PHP is a component used to offer, serve and build websites, a framework inside which a site and its components run. Two critical vulnerabilities have been found that can be exploited, meaning servers could be reached without knowing a username or authentication details. RIA is not yet aware of the flaws being exploited in Estonia's web environment, but it is monitoring the situation continuously. He said PHP is one of the most widespread frameworks in web services, including Drupal, Joomla and WordPress, so Estonia certainly has tens of thousands of servers susceptible to the vulnerability.

At 17:00 on Wednesday, Estonian time, an updated version is due in which the holes are fixed in the source code. Raasuke said website owners must update the PHP framework on their servers so the flaw cannot be used against them. The PHP security team has said details of the vulnerabilities, affected versions and fixed releases will be published together with the patches. The security update notice rated both flaws 9.2 on the CVSS v4.0 scale and called on users to install the update as soon as it becomes available.

RIA recommends that administrators of every system using PHP prepare to install the fixes without delay. On information known so far, exploitation may allow an unauthenticated attacker to run any commands on a vulnerable system, and reports of possible exploitation methods have already appeared in public. The authority said PHP is widely used in web applications, internet-connected and internal information systems and container environments, so the weaknesses pose a significant risk to many systems. Service providers and administrators should identify all PHP systems at the first opportunity and be ready to patch immediately after publication. If systems cannot be updated without delay, temporary mitigations should be applied.

The EU computer-incident response unit CERT-EU said in a threat assessment published on Tuesday that a severity of 9.2 indicates a risk of unauthenticated remote code execution, a flaw that lets attackers run malicious code on vulnerable systems without logging in. CERT-EU urged organisations to prepare to patch affected systems immediately and advised those that cannot to consider removing websites from the network temporarily. Australia's Cyber Security Centre gave similar guidance, asking organisations to find PHP systems, prepare to install the fixes and watch applications for signs of malicious activity. The centre said it is not currently aware that the holes are being actively exploited.

Finland's state IT centre Valtori said in a statement that it closed the state's public web services on Wednesday as a precaution because two critical holes had been found in widely used PHP software. Valtori said no attempts to exploit the holes had been detected and the outage was not caused by a data leak. The Dutch cybersecurity authority said it had closed its own website as a precaution. Latvia also closed state websites, and the portal of Latvian public broadcaster LSM is down because of the security risks. Raasuke said that if Latvia or Finland have closed important sites, such as a government homepage or a public broadcaster's website, Estonia does not face a danger that would require the same step.

PHP runs a large part of the internet, and over the past day speculation has spread that sites using the software could fall victim to serious cyberattacks. Cybersecurity company Huntress said in a blog post that PHP is everywhere and quietly runs WordPress, Drupal, Joomla and Magento pages, shared hosting platforms, control panels and a huge amount of software that does not advertise PHP as its engine. Cloudflare chief technology officer Dane Knecht said the first attacks have already begun and that Cloudflare is updating its firewall rules as a temporary measure as new attack vectors appear. He wrote that this is only a temporary solution and that the fix should be installed as soon as PHP publishes the update.

Hosting provider GoDaddy said the holes may allow attackers to run code over the internet on affected servers, which could potentially lead to data theft, website defacement or compromise of the whole system. Developers of Wordfence, a security plugin for WordPress, noted that all WordPress sites run on servers equipped with PHP. The company warned that automatic updates do not install this security fix and advised site owners to find out who is responsible for updating PHP.

According to a blog post by Wiz, a cybersecurity company owned by Alphabet, the PHP holes were discovered with the help of artificial intelligence. The post said the flaws had lain in the PHP codebase for more than ten years and would have been exceptionally difficult for a human hacker to exploit. Wiz said the research relied on its autonomous AI vulnerability-hunting tool Wiz Atlas, Google's Gemini 4 Argon model and OpenAI's GPT-5.6 Sol model. On finding the hole and checking the security fix, Wiz worked with the PHP team, OpenAI and cybersecurity firm Calif. To protect customers and prepare defences it also worked with Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, which operates WordPress.com, and several other companies. According to a White House statement, the vulnerability became known on Friday. The statement said the discovery shows why American leadership in artificial intelligence is critically important, referring to President Donald Trump's preferred term for the technology, and described it as American innovation strengthening national security.