European Governments Take Websites Offline Following Critical PHP Security Vulnerabilities

Governments in Europe have taken websites offline in response to warnings about critical security vulnerabilities in PHP, a programming language that underpins a significant portion of the internet. Finland’s government announced it was taking all public-facing internet services offline as a precautionary measure, while Dutch national and local government websites were also taken down.

The programming language contains two vulnerabilities that could potentially expose organizations using it in websites and software platforms to cyberattacks. The UK’s National Cyber Security Centre issued an alert advising organizations to identify systems running PHP, check them for malicious activity, and consider taking them offline until the vulnerabilities can be mitigated.

The developers responsible for maintaining PHP released software updates to patch the vulnerabilities, urging users to adopt those changes immediately. A White House official stated that the US government is coordinating with federal agencies and technology companies to adopt the security fix.

PHP is one of the web's most widely deployed technologies, underpinning millions of websites and powering platforms like WordPress, Drupal, Joomla, and Magento. Cybersecurity firm Huntress noted that any vulnerability can cascade through the internet's software supply chain, potentially exposing online services to data theft, malware, and breaches. Taking sites offline prevents attackers from reaching and exploiting the flaws during the patching process.

Alphabet Inc.-owned cybersecurity company Wiz reported that it discovered the vulnerabilities with the help of artificial intelligence tools, collaborating with OpenAI and the cybersecurity firm Calif. Wiz estimated that the PHP vulnerability affected around 70% of the internet and had existed undetected for more than a decade. According to Wiz, AI tools helped quickly identify a fix, noting that a single researcher completed work in a week that previously would have taken a world-class team months.

The impact of the outages extended across various sectors. The websites for the Dutch House of Representatives and the National Cyber Security Centre were unreachable, and Dutch news agency ANP reported that over 100 municipalities, provinces, and water boards were affected through a service provided by software firm Notubiz. Additionally, universities in Austria and Germany, including the University of Vienna and the University of Freiburg, pulled their sites offline.

Cybersecurity firm Cloudflare Inc. observed early attacks attempting to exploit the vulnerabilities. In response, Cloudflare introduced protections for customers using its technology to shield their sites.

"This incident highlights the critical reliance of modern digital infrastructure on foundational software like PHP. When core technologies face severe vulnerabilities, the disruption can quickly cascade across global public and private sectors. For businesses, this serves as an important reminder to maintain robust software supply chain visibility, regularly audit dependencies, and maintain rapid incident response protocols to protect digital assets against sudden cyber threats." — Dr. Shishir Gupta, Founder & CEO, StartupLanes