Hospitals, disaster agencies, airlines go offline as PHP security flaw triggers wave of shutdowns across US, Europe, Japan

Since a security vulnerability was discovered in the programming language PHP, websites across the United States, Europe and Japan have been going temporarily offline as a precautionary measure against hacking, drawing growing complaints from users. Governments are urging organizations to take their sites offline if patches and other fixes have not been applied, while working to develop national-level cybersecurity responses.

In the United States, news that AI had detected the PHP vulnerability spread Wednesday (local time), prompting universities and research institutions to take their websites offline from Wednesday through Thursday as a precautionary measure. UCLA, Georgetown University, the University of Virginia and Rutgers University temporarily shut down their sites to protect research databases and registered user information, with some universities saying they were in the process of applying security updates. In California, city councils including that of Half Moon Bay suspended access to some web content, including meeting agendas.

Across Europe, government portals, broadcasters and universities suspended their websites. In the United Kingdom, 32 government services went temporarily offline. The BBC also took down some of its web portal services that day. The University of Freiburg in Germany said it shut down its site Wednesday and restored it Thursday. The Czech Republic closed its official government website starting at 7 p.m. Wednesday for security patching, and Finland's national IT center shut down public government web services as a precautionary measure against hacking.

In Japan, the National Tax Service suspended its online services, making it impossible for users to check or pay their taxes online. In Tottori Prefecture, authorities temporarily suspended a disaster information portal as a typhoon approached, leaving residents unable to access information on the storm's speed, location or river water levels. The Japan Meteorological Administration also suspended its website in the early hours of Thursday, cutting off access to regional weather forecasts. The agency said it began restoring the site in stages from Thursday evening.

Medical institutions including Osaka Habikino Medical Center and Hokkaido City Kushiro General Hospital also took their websites offline, making it impossible to book or change medical and health checkup appointments. In Kanagawa Prefecture, a website for scheduling driver's license renewals was down for about 15 hours from early Thursday morning, resuming only late that afternoon after emergency repairs. Tourist sites including the Imperial Palace and Sento Imperial Palace in Kyoto also suspended their reservation systems. Japanese airline ANA said it had suspended its website and app services, including Apple Wallet boarding passes.

Experts recommended taking websites offline if security patches and other fixes have not been applied, even at the cost of some inconvenience to daily life. Governments have largely heeded that advice, convening emergency meetings to coordinate responses. Japan's Metropolitan Police Department called an emergency meeting Thursday, instructing agencies to consider measures including data encryption and the deletion of unnecessary personal data.

Japan's ruling Liberal Democratic Party decided Thursday to formally propose strengthening cyber defenses by deploying white-hat hackers. The plan calls for training such hackers at a high-level cybersecurity talent development facility run by the Information-technology Promotion Agency, which falls under the Ministry of Economy, Trade and Industry, and for establishing personnel and pay systems that would allow the government and public institutions to hire private-sector white-hat hackers at market-competitive rates.

Meanwhile, ahead of any government response, warnings emerged that PHP-based organizations should first check whether their systems have already been compromised. Spencer Young of US cybersecurity firm Delinea said that if attackers had already exploited the PHP vulnerability, they may have obtained passwords or digital keys, which could allow them to re-enter systems even after the flaw is patched. "This means security risks could linger long after the immediate threat is addressed, with attackers retaining the means to re-infiltrate and waiting for another opportunity to strike," he said.