Government websites across Europe went offline on Wednesday as a security alert over two critical vulnerabilities in PHP, a programming language used by much of the internet, triggered an international response.
Developers released emergency fixes on October 21, while cybersecurity agencies urged organisations to update affected systems immediately or temporarily take vulnerable websites offline.
The incident has raised concerns about how quickly attackers could exploit the flaws now that details of the weaknesses are public.
Also Read: SBI Data Leak Explained: What Happened, What Customers Should Know and How Banks Can Prevent It
PHP Security Flaw: Why Websites Are at Risk
PHP runs behind websites, processing information on servers before delivering pages to visitors. Platforms including WordPress, Drupal, Joomla and Magento widely use it.
According to web technology tracker W3Techs, PHP powers roughly 75% of websites whose programming language can be identified. The Drupal Association’s interim chief executive, Tiffany Farriss, warned that servers running PHP versions released over the past 20 years could be vulnerable.
Internet intelligence firm Censys estimated that about 1.5 million of 2.6 million hosts were running PHP versions for which no fix was available at the time of its assessment.
Also Read: Japan Declares Cybersecurity Emergency as AI-Driven Attacks Expose 14 Million Citizens’ Data
AI Helped Uncover Vulnerabilities Hidden for Years
Cybersecurity companies Calif and Wiz independently reported discovering the flaws using AI tools. Calif said it identified the vulnerabilities on August 1 using a large language model, while Wiz cited its Wiz Atlas research tool, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
Wiz said the weaknesses had remained hidden in PHP’s code for more than a decade and would have been exceptionally difficult for human hackers to exploit.
Amazon security chief CJ Moses said the company detected an attempted attack against a decoy system on October 17, four days before public disclosure. Further attempts followed on October 21. Amazon said attackers were exploiting the flaws in the wild, though it remained unclear whether the early attempts would have succeeded against real websites.
Also Read: India Reports Rogue AI Agent Activity: Personal Data and Confidential Business Records Exposed
Netherlands, Finland and France Take Precautionary Action
The Dutch government, Port of Rotterdam, Overheid.nl, the national football association KNVB, major political parties and several hospitals took websites offline.
Denmark’s Kombit shut down services, including the national school communication platform. Finland’s Valtori suspended government public network services, while France’s Interior Ministry placed all its websites under preventive maintenance. Wikipedia and the Internet Archive also temporarily took systems offline.
The European Union Agency for Cybersecurity and other authorities urged organisations to install fixes or disconnect affected systems until they could secure them.
The immediate priority is patching vulnerable servers and monitoring for attempted intrusions. For website operators, the episode also shows how AI-assisted vulnerability research can speed up both security discovery and attackers’ race to exploit newly exposed weaknesses. The focus now is whether organisations can secure exposed systems before attackers gain a wider foothold.
Samarjit Kaur is a journalist and communications professional covering technology & emerging digital trends. With a focus on clarity and context, she reports on developments shaping industries and governance. When not reporting, she chooses to plug-in and relax on her playlists and plan her next bucket-list trips!
