Hundreds of government, hospital, and school websites across Europe and beyond have been taken offline after the discovery of two critical security flaws in PHP, a programming language powering a large share of the internet. The vulnerabilities, disclosed late Tuesday, triggered urgent warnings from cybersecurity agencies and a global rush to apply emergency patches.
The US National Security Agency (NSA) advised organizations to immediately take their systems offline if they could not patch the vulnerabilities, warning that the flaws could provide a “direct path” for attackers to exploit databases and server file systems. European and British authorities also recommended that affected websites be temporarily taken offline until fixes could be applied, according to multiple reports.
Government websites in the Netherlands, Finland, Germany, Belgium, and the Czech Republic were among those taken offline as a precaution, with the Port of Rotterdam and national digital identity services also affected, according to sources cited by The Guardian and Al Jazeera. The PHP maintainers released urgent patches for affected versions on Wednesday morning, calling it “imperative” for organizations to update immediately.
PHP is a widely used open-source scripting language that underpins popular platforms such as WordPress, Drupal, Magento, and Laravel. According to industry estimates, PHP is used by nearly 70% of websites globally, including major commercial and governmental platforms. The vulnerabilities were reportedly uncovered with the help of artificial intelligence tools, and cybersecurity firms observed in-the-wild exploitation attempts shortly after the disclosure.
Cloudflare, a leading web and cloud security provider, said it was updating its firewall rules as a stopgap measure while administrators rushed to install the official patches. CERT-EU, the European Union’s cybersecurity agency, warned that many commercial and open-source products using PHP could also be impacted, even if they do not directly expose a PHP installation.
Officials and experts have expressed concern that poorly maintained or unmonitored websites may remain vulnerable for months, increasing the risk of large-scale cyberattacks. The longer-term impact remains uncertain, as the flaws had reportedly been present in PHP for years before their discovery and public disclosure.
As of today, the full status of all affected websites remains unclear, with many organizations still working to assess their exposure and apply the necessary patches. Cybersecurity agencies continue to urge vigilance and immediate action to prevent potential exploitation.
Authorities and security experts say the situation is evolving rapidly, and further disruptions may occur as more organizations respond to the incident and as attackers attempt to exploit unpatched systems.
The image accompanying this article is an AI-generated illustrative depiction inspired by the actual scene of the event.
