Government websites across Europe were taken offline on October 21 after critical vulnerabilities were discovered in PHP, a widely used programming language that powers a large share of the internet. Authorities in the Netherlands, France, Denmark and Finland temporarily suspended online services as a precaution, while cybersecurity agencies urged website operators to apply emergency security updates or disable vulnerable systems.
PHP developers released security fixes after researchers identified flaws that had reportedly remained undetected for more than a decade. Cybersecurity firms warned that attackers were already attempting to exploit the vulnerabilities, raising concerns about potential attacks on websites that had not yet been updated.
According to internet intelligence company Censys, around 1.5 million of the 2.6 million identified hosts were running PHP versions for which no fix was available. PHP supports major content management platforms, including WordPress, Drupal, Joomla and Magento, and powers approximately 75% of websites whose server-side programming language can be identified.
Cybersecurity companies Calif and Wiz independently reported discovering the vulnerabilities with the help of artificial intelligence. Wiz said its research combined its autonomous vulnerability detection system, Wiz Atlas, with advanced AI models to identify weaknesses that would otherwise have required extensive manual investigation.
Amazon also reported detecting attempted exploitation against its security testing systems as early as October 17, four days before the vulnerabilities were publicly disclosed. Amazon security chief CJ Moses said further attempts were recorded on Wednesday, although it remained unclear whether the attacks would have succeeded against live websites.
Several public and private services were affected. The Netherlands' National Cyber Security Centre took its website offline, while other affected services included Overheid.nl, the Port of Rotterdam, hospital websites and political party websites. France's Interior Ministry placed its websites under preventive maintenance, Finland's government IT provider Valtori suspended public network services, and Denmark's municipal IT provider Kombit shut down several services, including its national school communication platform.
Wikipedia temporarily disabled some systems, while the Internet Archive experienced a brief interruption. Automattic, the company behind WordPress.com and Tumblr, said users of its hosted services were protected against the vulnerabilities.
Cybersecurity specialists warned that smaller organisations and websites running outdated PHP versions could face greater risks because they may lack the resources to deploy security updates quickly. With patches publicly available, experts cautioned that attackers could use AI to analyse the flaws and target unpatched systems, making timely updates and stronger cybersecurity measures essential for website operators.
