Government websites in Europe and elsewhere went offline on Wednesday after developers of the PHP programming language disclosed two critical vulnerabilities. A fixed version went live the same day, but officials say all PHP versions from PHP 5 onward could be affected.
Government agencies in the Netherlands and Finland took sites offline as a precaution before the fix arrived, after reports that hackers were exploiting the flaws to break into websites. The Dutch cybersecurity agency itself went offline for the same reason.
Outages spread across Europe
In the Netherlands, several organizations followed the National Cyber Security Center, taking down the Port of Rotterdam, the government portal Overheid.nl, the national soccer association KNVB and several hospital websites. Finland's state IT services provider Valtori said it had taken government public network services offline as a precaution.
France's Interior Ministry temporarily took local government administrative websites offline while awaiting a security fix. Meanwhile, Danish municipal IT company Kombit shut down several services, including the national school communication platform.
Why PHP raises the stakes
PHP runs roughly 75% of websites whose programming language can be identified, according to W3Techs. It also powers WordPress, which runs about 43% of all websites. Wordfence warned that automatic updates would not apply the fix.
Security experts said attackers could scan the internet for systems running vulnerable versions rather than target victims one by one. Lukasz Olejnik of King's College London said AI-assisted hacking campaigns could magnify the threat. "The scale is huge," Olejnik said.
An AI model found the flaws
According to Business Insider, Calif, a cybersecurity research company, first identified the critical flaw using GPT-5.6 Sol, and OpenAI said Wiz independently uncovered the issues. Both companies are part of an OpenAI-led initiative called "Patch the Planet".
OpenAI also said the vulnerabilities appear to have been identified before attackers discovered them. Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take websites offline until patches could be applied.
Sources: CNBC, Business Insider
Trading involves risk.
Risk Disclaimer
