PHP Flaw Forces Government Websites Offline

On Wednesday, October 21, government agencies in Europe took public-facing websites offline after developers disclosed critical vulnerabilities in PHP and urged users to install urgent fixes. The shutdowns put public services behind precautionary barriers while operators tried to secure systems they rely on to reach the public.

The risk isn't shared evenly. Small PHP-powered websites run by individuals or organizations with limited technical resources face greater exposure, the article reports. Many use shared hosting services, where customers don't directly manage the underlying servers. Censys reported that about 1.5 million of 2.6 million hosts were running a PHP version with no available fix.

Who bears the risk

“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.” PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. Volunteers maintain the free, open-source software, which WordPress, Drupal, Joomla and Magento sites use.

Cybersecurity agencies worldwide urged PHP users to update immediately or take their websites offline until they could apply patches. Operators face a blunt tradeoff: risk an intrusion or withdraw a site from public access while applying a fix. The article identifies no community-led response or mutual-aid effort. Website operators, cybersecurity agencies and technology companies took the reported action.

The Dutch cybersecurity agency went offline as a precaution. Wikipedia's operator took an unspecified number of systems down until staff could patch them safely, and the Internet Archive briefly went offline to address the issue. In the Netherlands, the Port of Rotterdam, government portal Overheid.nl, national soccer association KNVB, websites for the country's five largest political parties and several hospital websites also followed the National Cyber Security Centre's example and shut their public-facing sites.

The scramble around the flaw

Danish municipal IT company Kombit shut down several services, including the national school communication platform. Finland's state IT services provider Valtori said government public network services were offline “as a precautionary measure.” France's Interior Ministry said it had placed all its websites into preventive maintenance.

The technical warning is stark. Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, said “AI was powering a ‘race to exploit,’” and warned that the next step was the “mass compromise of every vulnerable web server on the internet.” Lukasz Olejnik, a visiting senior research fellow at King's College London, said AI-assisted hacking campaigns could wreak havoc on unpatched servers. “The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said.

Two cybersecurity companies said artificial intelligence helped uncover the flaw. Calif said it found the vulnerabilities with help from a large language model on Aug. 1 and had worked on a fix since then. Alphabet-owned cybersecurity company Wiz said it used Wiz Atlas, its autonomous AI vulnerability research tool, along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Calif and Wiz said they coordinated with each other, the PHP team and OpenAI on the discovery.

Warnings from the top

Amazon security chief CJ Moses said Amazon's security team detected an attempt against one of its decoy “honeypot” systems on Oct. 17, four days before public disclosure. He said the attempt came from an anonymous internet address, though nobody knew how the actor learned of the flaws while they were under embargo. Amazon said multiple actors made further attempts on Wednesday before the embargo lifted. It remained unclear whether any attempt would have worked against real websites. The company said the flaws were “now being broadly exploited in the wild.”

Automattic, the operator of WordPress.com, said users of its hosted solutions and Tumblr were safe from the bug. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi wrote on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix.” The White House said in a statement it had been made aware of the flaw on Friday. For operators without direct control over their servers, the warning comes with the same hard choice: trust the infrastructure, or take the site dark.