Websites taken down across Europe ahead of critical cyber-security update

The Finnish and Dutch governments have taken down websites ahead of a planned software update to a programming language which underpins many online services.

Two critical vulnerabilities with the PHP programming language, which is widely used across the internet, have been identified - a fix is being issued for them on Wednesday afternoon.

Multiple cyber-security agencies have urged organisations to rapidly adopt the updates, or consider taking their websites offline.

Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency says it is taking its own website offline due to the vulnerabilities.

The country's National Institute for Public Health and the Environment, an agency of the Dutch government, has taken down its website.

Similarly the website of the Tweede Kamer, the lower house of the nation's parliament, has become inaccessible.

The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes as soon as they become available.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note.

Japan's national cyber-security office and EU cyber-security officials have issued a similar warning.

"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cyber-security company Huntress said.

Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would "likely be a priority target" for hackers.

The immediate challenge was not simply installing a patch to fix the issue, but finding and managing every instance where PHP was running, he said.

"The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it.

He said it was crucial that organisations looked out for signs that an attacker "might have already have gained a foothold".