PHP vulnerability: Which websites and services are affected?

If some of your usual websites aren’t working today, their operators may have temporarily shut them down to keep hackers out.

Two serious security flaws have been discovered in PHP, a programming language that helps websites run. On vulnerable servers, those flaws could allow hackers to run their own commands or access sensitive information. Because PHP is used across so many different websites, the same security problem has left operators around the world scrambling to protect their systems.

A fix became available on Oct. 21, but releasing it doesn’t automatically secure every affected site. Website operators and hosting providers still need to install the update on their servers. Some have taken sites offline or restricted features while they do that work, creating disruptions for visitors along the way.

From gaming services to government websites

Those precautions have disrupted everything from online forums to gaming services. 4chan switched to read-only mode while awaiting a PHP security update, while Wikimedia, the organization behind Wikipedia, took supporting tools offline until they could be safely patched. In a statement to Mashable, the Wikimedia Foundation confirmed its recent downtime was related to the PHP security issues.

Fur Affinity, Pinboard, and Miraheze also announced precautionary shutdowns, while games including Umamusume: Pretty Derby, Granblue Fantasy, and Princess Connect! Re:Dive announced maintenance to address PHP vulnerabilities.

Government websites have taken similar precautions. Reuters identified the Port of Rotterdam, Dutch football association KNVB, government portal Overheid.nl, and the Dutch National Cyber Security Centre among those taken offline. Finnish government public web services, Belgian foreign ministry websites, French prefecture websites, and several German federal websites also underwent preventive shutdowns. Taking these services offline doesn’t necessarily mean they were hacked — it can help prevent that from happening.

Other disruptions haven’t been publicly linked to PHP. Pokémon Sleep, Pokémon HOME, and Pokémon Champions underwent emergency maintenance, but a PHP connection remains unconfirmed. GOG also announced maintenance without specifying a cause, while Duolingo reported increased errors without mentioning the vulnerability. In addition, DownDetector users are reporting problems with popular tools such as the Internet Archive and Asana, though those issues couldn’t be directly linked to the PHP security update.

See more

This Tweet is currently unavailable. It might be loading or has been removed.

See more

This Tweet is currently unavailable. It might be loading or has been removed.

See more

This Tweet is currently unavailable. It might be loading or has been removed.

Here’s what we know about the PHP-related disruptions and the other outages happening alongside them.

Which websites are affected by the PHP security update?

The following sites and services have announced PHP-related restrictions or shutdowns, or have been reported to have taken them. These disruptions occurred at different points on Oct. 21, so some services may have returned as operators completed their updates.

• OpenStreetMap’s wiki and secondary services: Its operations team temporarily shut down several supporting services, including its wiki. The announcement concerns those services, rather than the main map.

• Choice of Games: The interactive fiction publisher announced an overnight shutdown of its website while awaiting the security update.

• GrapheneOS forum: The project temporarily took its discussion forum offline. This concerns the forum, rather than the GrapheneOS phone operating system.

• Umamusume: Pretty Derby: The game’s maintenance notice identified a PHP vulnerability on its servers, according to Dexerto.

• Something Awful: The forums posted a maintenance notice linking their temporary shutdown to the PHP vulnerability. The forum homepage was accessible during our check.

• 4chan: The imageboard switched to read-only mode while awaiting an urgent PHP security update, according to reporting quoting its notice. That limits posting without necessarily preventing people from reading existing threads.

• Wikimedia supporting services: The organization behind Wikipedia took services including Toolforge and Cloud VPS offline. Wikimedia also warned that users might encounter wiki outages during the work. (Its announcement does not describe a complete shutdown of Wikipedia.)

• Fur Affinity: The art community announced it would take its site offline until it could apply a patch, citing the PHP vulnerability.

• Miraheze: The wiki hosting service said it was taking all services offline to protect its systems while awaiting a PHP patch.

• Pinboard: The bookmarking service said it had taken itself offline to protect users’ data until patches became available.

• Granblue Fantasy: The game issued a maintenance notice related to the PHP vulnerability.

• Princess Connect! Re:Dive: The game also announced maintenance to address the PHP issue.

• Shadowverse: Worlds Beyond: The game underwent emergency maintenance that Japanese technology outlets linked to the PHP security issue.

• CHUNITHM: The rhythm game’s international account announced emergency maintenance following reports of a PHP vulnerability.

• Pokémon Sleep, Pokémon HOME, and Pokémon Champions: The games underwent emergency maintenance, though a direct connection to the PHP vulnerabilities has not been confirmed.

• Port of Rotterdam: Its website was taken offline as a precaution.

• KNVB: The Dutch national football association’s website was taken offline.

• Overheid.nl: The Dutch government portal was taken offline.

• Dutch National Cyber Security Centre: The cybersecurity agency took its public-facing website offline as a precaution.

• Finnish government public web services: State IT provider Valtori shut down the services as a precaution.

• Belgian foreign ministry: The ministry temporarily took its websites offline.

• French prefectures: The Interior Ministry temporarily took local administrative offices’ websites offline.

• German federal websites: Federal IT provider ITZBund temporarily deactivated several websites as a preventive measure.

When will affected websites be back?

There’s no single restoration time. Each operator needs to update its affected systems and make sure its services can safely return.

That process can be more complicated for organizations hosting tools managed by different people. Wikimedia, for example, said some volunteer-run services require their individual owners to make changes before they can come back online, potentially extending their downtime.

Want to learn more about getting the best out of your tech? Sign up for Mashable’s Top Stories and Deals newsletters today.