PHP Flaw Forces Government Websites Offline

Government websites across Europe went dark on Wednesday, October 21, 2026, after developers disclosed critical vulnerabilities in PHP, the programming language behind much of the public web. Agencies took sites offline as a precaution, while technology firms warned that hackers were already exploiting the flaws.

The scale is hard to overstate. “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.” Web technology tracker W3Techs says PHP runs roughly 75% of websites whose programming language can be identified. WordPress, Drupal, Joomla and Magento all run on it.

A Race to Exploit

PHP developers released urgent fixes Wednesday for bugs that had sat in the software for years, urging users to update immediately. But a public fix cuts both ways: experts said a patch, paired with artificial intelligence tools that can reverse-engineer the bug, could spark a wave of intrusions as hackers target vulnerable systems before updates arrive.

Costin Raiu, co-founder of cybersecurity firm TLP:Black, said AI was powering a “race to exploit.” He warned the next step was the “mass compromise of every vulnerable web server on the internet.”

The numbers aren't reassuring. Censys, an internet intelligence firm, reported that about 1.5 million of 2.6 million hosts were running a PHP version with no available fix.

Amazon security chief CJ Moses said in a blog post late Wednesday that the company’s team detected an exploit attempt against one of its decoy “honeypot” systems on Oct. 17, four days before public disclosure. The attempt came from an anonymous internet address. How the actor learned of the flaws while they remained under embargo is unclear. Multiple actors tried again Wednesday before the embargo lifted, and Amazon said the flaws were “now being broadly exploited in the wild.”

Government Sites Go Offline

The precautionary shutdowns spread widely. The Dutch cybersecurity agency went offline, along with the Port of Rotterdam, government portal Overheid.nl, national soccer association KNVB, the websites of the country’s five largest political parties and several hospital websites. They followed the National Cyber Security Centre’s lead. The Dutch prime minister said he was closely monitoring the situation.

Denmark’s municipal IT company Kombit shut down several services, including the national school communication platform. Finland faced wider disruption: state IT services provider Valtori said government public network services were offline “as a precautionary measure.” France’s Interior Ministry put all its websites into preventive maintenance.

Private-sector and nonprofit operators took similar steps. Wikipedia’s operator said it had taken an unspecified number of systems down until staff could patch them safely, and the Internet Archive said it briefly went offline. Automattic, which operates WordPress.com, said users of its hosted solutions and Tumblr were safe. Japanese Prime Minister Sanae Takaichi wrote on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix.”

How the Flaw Surfaced

Two cybersecurity companies said AI helped uncover the vulnerabilities. Calif said it found them with help from a large language model on Aug. 1 and had worked on a fix since then. Alphabet-owned Wiz said it discovered them using Wiz Atlas, its autonomous AI vulnerability research tool, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said the flaws had remained hidden in PHP’s codebase for more than a decade and would have been extraordinarily complicated for a human hacker to exploit.

“Pre-AI, this manual work would be difficult to implement and even harder to scale,” Wiz’s post said. “With AI, this is no longer a barrier.” The two firms said they coordinated with each other, the PHP team and OpenAI. The White House said it learned of the flaw on Friday.

PHP is free, open-source software maintained by volunteers. Lukasz Olejnik, a visiting senior research fellow at King’s College London, said AI-assisted hacking campaigns, which had proliferated in recent weeks, could wreak havoc on unpatched servers. “The scale is huge, and with AI, exploitation may happen instantly,” he said.

Small PHP-powered sites face the greatest risk. Individuals and organizations with limited technical resources often run them on shared hosting, where customers don't directly manage the underlying servers.

Why This Matters:

The episode shows how much of the modern economy and public administration rests on software maintained by unpaid volunteers. When a flaw surfaces, governments, hospitals and small businesses alike scramble, while people who depend on those services bear the costs of downtime. It also shows how quickly AI tools can shrink the window between disclosure and attack, rewarding operators who patch fast and exposing those without the resources to do so. Private firms like Amazon, Wiz and Calif found and tracked the threat; public agencies chiefly responded by switching sites off. Policymakers will likely face pressure to act. From a market perspective, the question is whether security incentives and private-sector coordination can keep pace before any heavier regulatory response takes shape.