The article has been updated with a note that Aula is up and running again.
On Wednesday, companies, organisations, and public authorities around the world temporarily took websites offline. Several Danish service providers did the same.
The shutdowns came after the PHP project released emergency fixes for two critical security flaws that were reported by security researchers using artificial intelligence tools.
PHP is a free, open-source programming language maintained by a community of developers and supported by the non-profit PHP Foundation. It is a basic building block of many websites.
Danish websites that were taken down include school platform Aula, the Danish Meteorological Institute’s website, and Copenhagen Municipality’s website.
The initial discovery
As reported by the BBC, the vulnerabilities were discovered by cyber-security firms Calif and Wiz, which had worked with the PHP Foundation using OpenAI tools to find and fix security flaws.
The discovered vulnerabilities were not supposed to make their way to the public for a while. However, they were leaked on Tuesday this week.
Upon the leak, there were reports from across the world of hackers attempting to use the vulnerabilities to gain access to websites that run on PHP.
The programming language is used for many websites, including for WordPress, which powers many smaller websites.
PHP quickly rolled out a patch on Wednesday that fixes the vulnerability. However, in the period between the leak on Tuesday and the patch on Wednesday, many website owners took their sites down for security.
Global consequences
The PHP vulnerability, which had been undiscovered for a decade but was all of a sudden made publicly known, had consequences across the world.
US, Japanese, EU, and Australian authorities were amongst the countries out warning website owners of the risks, with the US National Security Agency suggesting owners take their websites offline while getting their PHP patched.
National and local authorities across the world have also taken their own websites down, including France, Finland, Czechia, the UK, Germany, and the Netherlands.
Denmark also experiences outages
In Denmark, authorities have also taken down several websites in the time between Tuesday and Wednesday.
This included the Danish Meteorological Institute’s website, Copenhagen Municipality’s website, and the Danish Road Directorate’s website.
The most noteworthy outage in Denmark, however, is the communication platform Aula, which is used by parents to communicate with their children’s schools in Denmark. An estimated 600,000 Danes log in to Aula every single day.
On Thursday morning, Aula is reported to be up and running again.
“Consider going offline”
Minister for Resilience and Preparedness Lisbeth Bech-Nielsen of the Green Left (Socialistisk Folkeparti) spoke to TV 2.
Here, she said, “It could potentially be really serious if system owners don’t get a security update done. If that’s not possible right now, then one should consider going offline.”
Also the Confederation of Danish Industry (Dansk Industri) went out to warn Danish website owners of the dangers of the PHP vulnerabilities.
In a press release they wrote, “we urge all members to find out today whether they use PHP, and to update immediately”.
