Government agencies, media organisations, and hospital websites in many countries have been taken offline while the US National Security Agency urged organisations to keep their websites dark if they cannot immediately fix two serious security flaws in PHP, a programming language behind a large share of the world's websites.

"Effective Immediately, all organisations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities," the agency said in its statement on Wednesday.

"These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated," it added.

The US agency said it will "follow up shortly with more specific guidance."

Several government, school and hospital websites in Europe were taken offline as organisations rushed to protect themselves from two critical security flaws in PHP.

CERT-EU, the EU's cybersecurity response team, had warned that organizations unable to apply fixes in time ‌should consider taking affected sites offline.

PHP's developers said a set of new updates fixing two previously identified critical vulnerabilities was now live and strongly encouraged users to utilise them immediately.

The Dutch government was among those that took sites offline as a precaution. Cloudflare said ​it was seeing early attacks emerging, while Australia's cyber agency said it was not aware of ​active exploitation.

A spokesperson for the German digital ministry told Reuters on Wednesday the federal IT service provider ITZBund had taken several websites offline due to ​the discovery of PHP vulnerabilities.

The temporary deactivation was purely preventive and no security incidents were known to have ​occurred, he said.

Countries take action

The Interior Ministry of France said it had temporarily taken the websites of prefectures, which are local government administrative offices, offline while ‌awaiting a ⁠security fix for the PHP framework they use.

It said the move was a precaution pending a patch from the framework's publisher.

Belgium's foreign ministry said it had temporarily taken its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although the country's cybersecurity centre said it had not recorded any attacks on Belgian websites.

Many organisations in Netherlands followed the example ​of the National Cyber Security ​Centre and preventively took ⁠their public-facing sites offline.

They included the Port of Rotterdam, government site Overheid.nl, the national football association KNVB, the websites of the five largest political parties and numerous hospital ​websites across the country.

State IT centre Valtori in Finland shut down the government's public web services on ​Wednesday as "a precautionary ⁠measure."

Valtori said it had not identified any attempt to exploit the flaws and that the outage was not the result of a data breach.

The Wikimedia Foundation, which runs online encyclopedia Wikipedia, said it was in the process of addressing security ⁠vulnerabilities in ​the PHP programming language.

All foundation-supported systems and volunteer-run systems that use ​PHP are affected, the foundation said in a statement.