A security problem in PHP: what it means for your website
Two critical weak spots were found in PHP, the software behind about 70% of all websites. The fix is out, and the client websites of Driezie Studio had no issues.
Update, 21 October: the fix is out, and there were no issues on the client websites of Driezie Studio. There is nothing you need to do.
Because PHP is so widely used, this touched many organisations at once. Here is what happened, in plain words, and why some websites were temporarily offline.
What happened? The makers of PHP found two critical vulnerabilities, each rated 9.2 (CVSS v4.0). A vulnerability is a weak spot that someone with bad intentions could use to get in. The 9.2 is a score from 0 to 10 for how serious it is: everything from 9 up counts as critical. The fix came out on Wednesday 21 October at 16:00 Dutch time.
Why did websites go offline? These weak spots could let an attacker take over the computer a website runs on, and everything stored on it. To be safe, many organisations took their websites offline until the fix was in, such as MijnOverheid, DigiD, the RIVM and the ANWB.
Was anyone attacked? Not as far as anyone knows. The Dutch National Cyber Security Centre (NCSC) had not seen any attacks. It advised everyone whose websites run on PHP to install the fix as soon as it came out.
What did this mean for your website? Nothing. The client websites of Driezie Studio had no issues from these weak spots, and there was nothing you needed to do. Driezie Studio kept an eye on it the whole time.
Sources: the announcement on php.net and the NU.nl liveblog.