Government websites across Europe and beyond went offline Wednesday after developers disclosed critical vulnerabilities in PHP, the programming language behind most of the public web. Citizens who depend on online portals for services, school communications and hospital information suddenly couldn’t reach them, as agencies chose blackouts rather than risk an intrusion.
PHP developers issued urgent fixes on October 21, 2026, for flaws that had lingered in the software for years. They urged everyone to update immediately. Technology firms warned that some hackers had already begun exploiting the bugs.
Who Is Affected
The reach is enormous. W3Techs says PHP runs roughly 75% of websites whose programming language can be identified. It powers WordPress, Drupal, Joomla and Magento sites. “All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.”
The public-sector fallout appeared quickly. In the Netherlands, the National Cyber Security Centre went offline as a precaution. Others followed: the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites of the country’s five largest political parties and several hospital sites. Danish municipal IT company Kombit shut several services, including the national school communication platform. Finland faced wider disruption, with state IT services provider Valtori saying government public network services were offline “as a precautionary measure.” France’s Interior Ministry put all its websites into preventive maintenance.
The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi wrote on X that website owners should “check whether your live site uses PHP and prepare to apply the new fix.”
The Patching Gap
Not everyone can fix this quickly. Censys, an internet intelligence firm, reported that about 1.5 million of 2.6 million hosts were running a PHP version for which no fix was available. Small PHP-powered websites run by individuals or organizations with limited technical resources face greater risks, especially on shared hosting services where customers don’t directly manage the underlying servers.
PHP is free, open-source software maintained by volunteers. Automattic, the operator of WordPress.com, said users of its hosted solutions and Tumblr were safe. Smaller operators without a large provider behind them face a harder road.
Cybersecurity agencies worldwide told PHP users to update immediately or take their websites offline until they could apply patches.
An AI-Powered Race
Two cybersecurity companies said artificial intelligence helped uncover the flaw. Calif said it found the vulnerabilities with help from a large language model on Aug. 1 and had worked on a fix since then. Alphabet-owned Wiz said it discovered them using Wiz Atlas, its autonomous AI vulnerability research tool, along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said the vulnerabilities had remained hidden for more than a decade and would have been extraordinarily complicated for a human hacker to exploit. “Pre-AI, this manual work would be difficult to implement and even harder to scale,” its post said. “With AI, this is no longer a barrier.”
Experts fear attackers can use the same tools. Costin Raiu, co-founder of TLP:Black, said AI was powering a “race to exploit,” with the next step being the “mass compromise of every vulnerable web server on the internet.” Lukasz Olejnik, a visiting senior research fellow at King’s College London, put it bluntly: “The scale is huge, and with AI, exploitation may happen instantly.”
Questions About the Embargo
Amazon security chief CJ Moses said in a blog post that the company’s security team detected an attempt to exploit the flaws against one of its decoy “honeypot” systems on Oct. 17, four days before public disclosure. The attempt came from an anonymous internet address, and it wasn’t clear how the actor learned of the flaws while they were under embargo. Multiple actors tried again Wednesday before the embargo lifted. Amazon said the flaws were “now being broadly exploited in the wild.”
Calif and Wiz said they coordinated with one another, the PHP team and OpenAI. The White House said in a statement that it had learned of the flaw on Friday.
Why This Matters:
When hospitals, school platforms and government portals vanish from the web in a single day, ordinary people who depend on those services pay the cost. The episode shows how much of the public internet rests on software volunteers maintain, without guaranteed funding for security work. It also shows who faces the greatest exposure: small organizations and individuals on shared hosting, with the least technical capacity to patch quickly. And as AI shrinks the time between disclosure and attack, the case for public investment in shared digital infrastructure, clearer rules for coordinated disclosure, and support for under-resourced site operators looks stronger. That’s a perspective, not a verdict, but this week’s facts point in that direction.
- php
- cybersecurity
- artificial intelligence
- website outages
- dutch cybersecurity agency
- netherlands
- wordpress
- vulnerability patching