PHP security flaws prompt government website shutdowns: report

Government websites across several European countries were temporarily taken offline on Wednesday, October 21, following an urgent warning about critical security flaws in PHP, RT reported. Developers released fixes and urged immediate updates, while organisations unable to patch their systems were advised to disconnect them as a precaution.

The reported vulnerabilities could allow attackers to execute code remotely and take control of affected websites. The shutdowns described in the report were protective measures; they do not establish that the affected services had been hacked.

Public services taken offline

France’s Interior Ministry temporarily shut down prefecture websites, with local government pages also becoming unavailable. Belgium’s Foreign Ministry took its websites offline on Wednesday.

In the Netherlands, the National Cyber Security Centre, all major political parties and at least one port reportedly took similar precautions. Denmark’s national school communication platform was temporarily shut down, while Finland’s government public web services became unavailable.

Disruptions also affected services operated by the Wikimedia Foundation, which runs Wikipedia. The report did not identify which of the foundation’s services were affected.

Urgent patching advice

The report said cybersecurity authorities in the United States, European Union, United Kingdom, Australia and Canada issued alerts calling for immediate patching, with priority given to internet-facing systems. These included the US Cybersecurity and Infrastructure Security Agency and the UK’s National Cyber Security Centre.

Organisations unable to install fixes immediately, including those using outdated and unsupported PHP versions, were advised to keep affected systems offline until they could be secured.

PHP is an open-source programming language used to run websites and generate content. The report puts its reach at roughly 70% of the web, but provides no methodology for that estimate. It also gives no vulnerability identifiers or affected and fixed version numbers, limiting its usefulness as a technical remediation guide.

Researchers describe AI-assisted discovery

Cybersecurity companies Calif and Wiz reportedly identified the flaws in August. PHP developers then worked on fixes without publicly disclosing the discovery, aiming to reduce the risk of exploitation before patches were ready.

The companies said they made extensive use of AI models, identified in the report as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Wiz said the underlying defects had existed for decades, but proving that they could be exploited required an unusually intricate sequence of steps near the limits of practical human research.

OpenAI characterised the case as a particularly consequential security issue and predicted further AI-assisted vulnerability discoveries in the coming months. Those assessments are attributed to the companies involved, rather than independent findings.

No affected Indian organisation or Indian government advisory is identified in the report. The extent of any exposure or disruption in India therefore remains unestablished.