PHP Crisis Disrupts National Government Websites

Government websites across Europe went offline Wednesday, October 21, after developers disclosed critical vulnerabilities in PHP and urged users to install emergency fixes. The shutdowns affected public-facing systems in several countries, including Dutch government services, Finnish state IT services and every website run by France’s Interior Ministry. Agencies took sites offline as a precaution while they worked to address the vulnerabilities.

Public services taken offline

PHP developers released fixes for vulnerabilities that had remained in the software for years. Cybersecurity agencies worldwide urged users to update immediately or take their websites offline until they could apply patches. National and local online services temporarily became inaccessible, though the article reported no confirmed government data loss or successful attack on those services.

In the Netherlands, the National Cyber Security Centre took its website offline as a precaution. The Port of Rotterdam, government portal Overheid.nl, national soccer association KNVB, websites for the country’s five largest political parties and several hospital websites followed suit. The Dutch prime minister said he was closely monitoring the situation.

Finland saw wider disruption. State IT services provider Valtori said government public network services were offline “as a precautionary measure.” France’s Interior Ministry put all its websites into preventive maintenance. Danish municipal IT company Kombit shut down several services, including the national school communication platform.

Wikipedia’s operator said it had taken an unspecified number of systems offline until staff could safely patch them. The Internet Archive said it briefly went offline to address the issue. Japanese Prime Minister Sanae Takaichi wrote on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix.”

A widely used system under pressure

PHP dates to the early 1990s, when it stood for “Personal Home Page.” It powers websites built with WordPress, Drupal, Joomla and Magento. Web technology tracker W3Techs says PHP runs roughly 75% of websites whose programming language can be identified. Tiffany Farriss, interim chief executive of the Drupal Association, said, “All servers using any version of PHP released in the last 20 years will be vulnerable.” She added: “This issue impacts the majority of the internet.”

Censys, an internet intelligence firm, reported that about 1.5 million of 2.6 million hosts ran a PHP version without an available fix. Small PHP-powered websites run by individuals or organizations with limited technical resources faced higher risks, the article said. Many use shared hosting services, where customers don’t directly manage the underlying servers. Automattic, the operator of WordPress.com, said users of its hosted solutions and Tumblr were safe from the bug.

AI discovery and exploitation concerns

Calif said a large language model helped it find the vulnerabilities on Aug. 1, and that it had worked on a fix since then. Alphabet-owned cybersecurity company Wiz said it found them using Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Calif and Wiz said they coordinated with one another, the PHP team and OpenAI on the discovery. The White House said it learned of the flaw on Friday.

Amazon security chief CJ Moses said Amazon detected an attempted exploit against a decoy “honeypot” system on Oct. 17, four days before public disclosure. The attempt came from an anonymous internet address, he said, but nobody knew how the actor had learned of the vulnerabilities while they remained under embargo. Amazon said further attempts came before the embargo lifted, and it remained unclear whether any would have worked against real websites. The company said the flaws “are now being broadly exploited in the wild.”

Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, said “AI was powering a ‘race to exploit.’” Lukasz Olejnik, a visiting senior research fellow at King’s College London, said, “The scale is huge, and with AI, exploitation may happen instantly.”