On Wednesday morning, chunks of the European internet quietly disappeared. Government portals in Finland went dark. The Netherlands' cyber-security agency shut down its own website. Denmark's national school platform, the Dutch parliament's site, hospitals, football associations and political party pages all followed. The cause was not a coordinated attack — it was a precaution, and a remarkable one: the software running most of the world's websites had been found to contain two critical holes, and nobody wanted to be online when attackers came knocking.
The flaws were in PHP, the server-side programming language that quietly powers an estimated 70 to 78 per cent of websites with a known server-side language — including sites built on WordPress, Drupal, Joomla and Magento. On Tuesday 20 October, PHP's developers announced two critical vulnerabilities and urged users to “upgrade as soon as the release is available”, scheduling emergency patches for 2pm GMT on Wednesday.
How serious is a 9.2?
Both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale, where 10 is the maximum — a score that puts them in the “critical” category. The EU's computer emergency response team, CERT-EU, said the ratings indicated the potential for unauthenticated remote code execution: in plain terms, an attacker might be able to run malicious code on a vulnerable server without ever logging in.
That is about as bad as it gets in web security. A flaw that requires no credentials and can be triggered remotely hands attackers a foothold on the server itself — potentially exposing passwords, API keys and tokens stored in memory, and opening the door to data theft, website defacement or full system compromise. Security firm Wiz, which disclosed the vulnerabilities, said hackers could exploit the bugs to execute remote code and access sensitive information held in memory. The flaws have already acquired a nickname in the security community: PHP2Shell, a blunt reference to what successful exploitation would deliver — a working shell on the target server.
As the Register's coverage detailed, the patches — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — address CVE-2026-109618 and CVE-2026-109619, and all PHP installations serving web requests are potentially affected, including deployments using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed.
Programming code on a computer screen, illustrating the software behind websites.
Credit: Martin Vorel (Bloxgros), Wikimedia Commons (CC BY-SA 4.0).
The shutdowns
What made Wednesday extraordinary was not just the severity of the flaws but the response. Rather than waiting for the patch and hoping for the best, government IT operators across Europe chose to pull the plug first.
Finland's state IT provider, Valtori, began taking public-sector websites and services offline on Wednesday morning. The agency stressed that the move was a precaution rather than a response to a confirmed intrusion, and said it had found no sign of actual exploitation — but judged the risk too high to leave sites running without a fix in hand. Finland's University of Tampere posted its own notice warning that web services might need to go dark, a sign of how far the alert spread beyond central government.
The Netherlands took similar action. The country's National Cyber Security Centre temporarily took its own website offline and advised operators to install updates immediately or consider shutting down exposed systems. The shutdowns extended across Dutch national and local government websites: the National Institute for Public Health and the Environment deactivated its site, the Tweede Kamer — the lower house of parliament — became inaccessible, and the Port of Rotterdam, the Overheid.nl government portal, the KNVB football association, hospitals and the five largest political parties' sites were all affected, according to Bloomberg's reporting via Geo News.
Denmark's Kombit shut services including the national school platform. In France, the Interior Ministry took down administrative sites of local governments. Privacy campaign group noyb — the organisation founded by Max Schrems — also temporarily withdrew its website, posting a notice that it was unavailable because of the critical PHP vulnerability.
Found by AI
There is a notable subplot to how the flaws surfaced. The BBC reported that the PHP vulnerabilities were found by AI via security firm Wiz — a sign of how artificial intelligence is reshaping vulnerability research, for better and worse. AI-assisted discovery can find dangerous bugs faster than human researchers alone; but the same capabilities in the wrong hands can also find them first.
The disclosure timeline added to the urgency. The vulnerabilities had reportedly been under embargo until Thursday 22 October, but their identifiers began circulating on Hacker News and social media on 20 October. Security firm watchTowr confirmed the vulnerabilities were real and said it had reproduced one of the two bugs, as Startup Fortune's detailed account described. PHP's maintainers then brought forward the emergency security release to 21 October at 14:00 UTC, with full technical details and affected versions due alongside it.
Jake Knott, head of threat intelligence at watchTowr, said his firm was already observing in-the-wild exploitation attempts, with a variety of hastily assembled proof-of-concept attacks hitting its sensors — “whilst nobody has been successful to date, we don't expect that will last long.” The observation captures the race now under way: defenders patching, attackers probing, and the window between the two measured in hours.
The official advice
Cyber-security agencies moved quickly to coordinate the response. CERT-EU urged organisations to prepare immediately to install patches and said those unable to do so should consider taking affected sites offline — the same scramble Reuters described as government websites across Europe went dark. The UK's National Cyber Security Centre advised: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
Australia's cyber agency said it was not aware of active exploitation but urged immediate action. The FBI's Cyber Division issued an urgent advisory, warning that the vulnerabilities “could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” as Business Today reported.
The incident is a reminder of how concentrated the web's foundations are. PHP's ubiquity — three-quarters of the known server-side web — means a single pair of flaws can put governments, hospitals, schools and businesses at risk simultaneously. Verity has covered the fallout of the ASOS customer data breach and the teen safety report on AI chatbots; this episode belongs to a different, more structural category of digital risk — the shared plumbing of the internet itself.
What happens now
The patches are out, and the immediate advice is simple: apply them. Cloudflare's CTO reported that attacks were already under way and that the company was adjusting firewall rules as an interim measure, advising everyone to “patch as soon as PHP releases the update.”
The deeper questions will take longer to answer. How many organisations actually patched in time? Did any attackers succeed before the fix landed? And what does it mean for the security of the web that its most widely used server-side language can be brought to a precautionary standstill by two flaws — found, fittingly or alarmingly, by AI?
For now, the websites are coming back online. The scramble of Wednesday morning — governments voluntarily switching off the lights to stay safe — will be remembered as one of the more dramatic days in the short history of internet security. It also arrives in a year when the security of AI systems themselves has been under scrutiny, from the Pentagon's decision to stop using Anthropic's AI tools to the wider crackdown on digital piracy straining online platforms. You can read more of our coverage in the Technology section.
