Government websites in Europe and elsewhere went offline on Wednesday, October 21, after PHP developers disclosed critical vulnerabilities and urged operators to install urgent fixes. Free and open-source PHP, maintained by volunteers, runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs. Government agencies, hospitals, political parties and public services all faced disruption.
Who Bears the Risk
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.” WordPress, Drupal, Joomla and Magento sites use PHP, putting the flaw across a broad share of public-facing web infrastructure.
Internet intelligence firm Censys reported that about 1.5 million of 2.6 million hosts ran a PHP version with no available fix. Cybersecurity agencies worldwide urged users to update immediately or take websites offline until patches could be applied. Small PHP-powered sites faced greater exposure, especially those run by individuals or organizations with limited technical resources, often on shared hosting services where customers don't directly manage the underlying servers.
The Dutch cybersecurity agency took its site offline as a precaution. Organizations in the Netherlands followed its National Cyber Security Centre's example, including the Port of Rotterdam, government portal Overheid.nl, national soccer association KNVB, websites for the country's five largest political parties, and several hospital websites. Wikipedia's operator said it had taken an unspecified number of systems down until staff could safely patch them. The Internet Archive briefly went offline, too, to address the issue.
Finland's state IT services provider Valtori said government public network services were offline “as a precautionary measure.” France's Interior Ministry placed all its websites into preventive maintenance. Danish municipal IT company Kombit shut down several services, including the national school communication platform. The Dutch prime minister said he was closely monitoring the situation. On X, Japanese Prime Minister Sanae Takaichi urged website owners to “check whether your live site uses PHP and prepare to apply the new fix.”
The Race to Exploit
According to Alphabet-owned cybersecurity company Wiz, the vulnerabilities had remained hidden in PHP's codebase for more than a decade. Calif said it found them with help from a large language model on Aug. 1 and had worked on a fix since then. Wiz said it used its autonomous AI vulnerability research tool, Wiz Atlas, along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Calif and Wiz said they coordinated with one another, the PHP team and OpenAI on the discovery. The White House said it learned of the flaw on Friday.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” Wiz said in a post. “With AI, this is no longer a barrier.” Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black, said AI was fueling a “race to exploit,” with the possibility of a “mass compromise of every vulnerable web server on the internet.” Lukasz Olejnik, a visiting senior research fellow at King's College London, warned that AI-assisted hacking campaigns proliferating in recent weeks could wreak havoc on unpatched servers. “The scale is huge, and with AI, exploitation may happen instantly,” he said.
Amazon security chief CJ Moses said the company's security team detected an attempt against one of its decoy “honeypot” systems on Oct. 17, four days before public disclosure. The attempt came from an anonymous internet address, he said, but no one knew how the actor learned of the flaws while they were under embargo. Multiple actors made further attempts on Wednesday before the embargo lifted. Amazon said it remained unclear whether any attempt would have worked against real websites, and that the flaws were “now being broadly exploited in the wild.”
Automattic, operator of WordPress.com, said users of its hosted solutions and Tumblr were safe from the bug. PHP developers released urgent fixes on Wednesday. Operators took services offline while working to protect systems.
- php
- cybersecurity
- artificial intelligence
- website outages
- dutch cybersecurity agency
- netherlands
- wordpress
- vulnerability patching