A severe security vulnerability in the PHP programming language—a core technology powering nearly 70% of the world’s websites—has triggered widespread system shutdowns as organizations scramble to apply emergency patches. Governments and private entities across Europe and Australia have taken platforms offline to mitigate the risk of exploitation. Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web. Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language used by almost 70% of websites. It means millions of websites will need to be fixed.
The critical weakness, which became public on Tuesday, prompted urgent warnings from national security agencies in London and Washington.
The US National Security Agency advised organizations to take affected systems offline immediately if they could not implement the necessary patch, warning that the vulnerability could provide a direct path for attackers to access a server’s file system or database. Similarly, the UK’s National Cyber Security Centre urged organizations to check for any existing backdoors installed by unauthorized actors. The big thing is for everyone using it to get that in to make sure their systems are safe. For the big juicy targets, I hope to goodness they are being patched quickly.”.
Wikimedia Foundation, which operates Wikipedia, reported taking several systems offline on Wednesday as a protective measure. Other prominent systems relying on PHP include WordPress and the messaging platform Slack, both of which are common targets for potential exploiters.
Government sites have also been heavily impacted. In the UK, local councils in Edinburgh, Bristol, and Oxford were forced to take their sites offline. France saw significant disruptions, including the Paris police prefecture, while the Netherlands took down its national digital identity service, national cybersecurity center, and the house of representatives website. The Australian Signals Directorate confirmed that it was affected by the outage overnight, noting that other government portals were likely impacted as well.
Cybersecurity expert Prof. Alan Woodward of Surrey University described the situation as both surprising and deeply troubling. He emphasized that while a patch was released quickly by the PHP project, the primary challenge remains the long-term maintenance of neglected websites. Woodward warned of a potential multi-month period of ongoing attacks against vulnerable, unmaintained systems.
Infrastructure expert Michał Woźniak warned of likely automatic exploitation, suggesting that the bug could be used by cryptocurrency miners to hijack server resources or by state actors and large-scale criminal syndicates as a launching pad for distributed denial of service (DDoS) attacks. Woźniak characterized the situation as an environmental issue within the tech industry, noting that incentives to prioritize speed over maintenance have left aging, decade-old vulnerabilities exposed. According to one internet infrastructure expert, Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks. “This is an environmental problem in an industry where there’s an incentive to move fast and make changes,” he said. “There’s an incentive to deploy a thing and then never update it and not think about maintenance.”.
OpenAI stated that a coalition of researchers, including their own, discovered the flaw. However, the specific researcher who identified the weakness clarified that they did not utilize any restricted AI models unavailable to the general public to locate the vulnerability. As the situation develops, security experts maintain that the current window of opportunity for bad actors makes immediate patching essential for all organizations utilizing the language. According to woodward, There was a window of opportunity for bad actors. “There is this race and some people unfortunately don’t even know they are in the race.”.
