Government sites around Europe and the world were offline on Wednesday, due to a serious PHP vulnerability. The instruction for site owners everywhere was straightforward: Run the PHP version checker to make sure you're up to date and update it.
What Happened to Government Websites
Several governments suspended services for the public. The sites of the National Cyber Security Centre, Overheid.nl, the Port of Rotterdam, the KNVB soccer association, the five largest political parties and various hospitals were offline in the Netherlands. Valtori, the state IT provider in Finland turned off public network services. All French government websites have been placed on 'preventive maintenance' by the country's Interior Ministry. Denmark's Kombit has ended a number of services, including a national school communication platform. In Japan, Sakura Internet stopped a function of database appliance. Some systems were also deleted by the operator of Wikipedia until they could be patched.
Why the PHP Vulnerability Matters
Written by volunteers, PHP is a free open source programming language. Generates every page in advance on the server and then sends it to your browser. It powers about 75% of websites that can be detected as being in a language other than English.It powers about 75% of websites that can be detected as being in a language other than English. It also sits underneath WordPress, Drupal, Joomla and Magento.
Tiffany Farriss, interim CEO of the Drupal Association, cautioned that any server with any PHP version from the past 20 years is susceptible to attacks. European, Australian, Japanese and British cybersecurity firms advised users to either update as soon as possible or remain offline until a patch is available.
How AI Discovered the Security Flaw
The vulnerabilities were discovered by Cybersecurity firm Wiz with the help of its AI cybersecurity research platform, Wiz Atlas and Google's Argon 4 Gemini and OpenAI's GPT-5.6 Sol. The bugs had been dormant for over 10 years. If they were to be exploited manually, it would have been extremely complex, but AI eliminates that hurdle, Wiz said.
Wiz collaborated with the PHP security team, OpenAI and security firm Calif on finding and patching the discovery. It also collaborated with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel to ready defenses for users.
The Race to Exploit
The same tech that can detect flaws can be used by attackers. With a fix now out there, AI can be used to unwind the bug with minimal effort. TLP:Black's Costin Raiu spoke of a "race to exploit," warning of potential "mass compromise" of vulnerable web servers. Some technology companies claim that attackers are already exploiting the vulnerabilities.
King's College London's Lukasz Olejnik said that there is a possibility for such exploitation to occur at once and on a large scale.
Small Websites Face the Highest Risk
Shared hosting is suitable for individuals and small organisations as the customers don't manage the underlying servers. Patches might take longer to arrive at those sites and they may remain exposed following patching. If you have a small site, you can contact your hosting provider and request the PHP update's timing.
What Website Owners Should Do Now
- Use the PHP version checker. Check if PHP is used on your live site. Prime Minister Sanae Takaichi pleaded with owners to do just that.
- Install the newest PHP update. The PHP developers advise updating all users "right away.
- Update your CMS. Install the latest versions of WordPress, Drupal, Joomla and Magento.
- Ask your host. In the case of shared hosting, make sure to verify the installation of patches in writing.
- Take a break from the Internet. If you can't patch immediately, then agencies recommend that you take the site down until you can.
- Monitor your logs. Beware of strange traffic, new administrative accounts and changes to files.
A Calm Way to Look at It
The disruption is genuine but so is the response. The researchers were found to be responsible, major cloud and security firms rushed in with fixes and the governments were quick to respond. Even if a few services are temporarily suspended, the measures taken today safeguard visitors, patients, students and citizens who depend on these services.
Keeping current and making sure to patch quickly are the best-controls. Be patient with the affected services and be sure that your own website is protected.
