Cover image: Close-up of computer code on a monitor screen — Markus Spiske / Unsplash (via Wikimedia Commons), CC0.
The week governments switched off their own websites
Something extraordinary happened on the internet last week, and most people never saw it. Within the space of 48 hours, governments across Europe began deliberately switching off their own websites — not because they had been hacked, but because they might be. Britain alone took 32 government services offline as a precaution. Finland, the Netherlands, France and Belgium followed. City councils in Edinburgh and Oxford went dark, and even the BBC took one of its own sites offline. It was, as Verity reported at the time, one of the most dramatic coordinated cybersecurity responses in recent memory, and it played out on front pages around the world.
The cause was a pair of critical flaws in PHP, the server-side programming language that quietly powers the majority of the world's websites. The vulnerabilities — tracked as CVE-2026-109618 and CVE-2026-109619, and dubbed "PHP2Shell" — scored 9.2 out of 10 on the standard severity scale, and both allowed an attacker to run their own code on a vulnerable server without any login or credentials. PHP's maintainers released emergency fixes on 21 October, a day after details leaked online, and the project's own advisory made the stakes plain: because the flaw lives in PHP's core engine rather than any particular application, patching the language itself was the only complete fix. Every PHP installation on earth was in scope.
The invisible engine room of the web
Here is the first thing this episode reveals: the modern internet runs on infrastructure most of us have never heard of. PHP was created in 1995, and it now sits underneath an estimated 70 per cent of all websites — including household names built on platforms like WordPress. When you open a government portal, a news site or a charity's donation page, there is a good chance a decades-old open-source language is doing the heavy lifting behind the curtain.
That invisibility is precisely the problem. We experience the web as a set of brands and logos — a bank, a council, a broadcaster — when in reality it is a set of shared pipes. A flaw in one company's app affects one company. A flaw in PHP affects everyone at once. Professor Alan Woodward of the Surrey Centre for Cyber Security estimated that something like 30 million websites could be at risk, and said an attacker exploiting the flaws could "basically do whatever they like." Ciaran Martin, the former chief executive of Britain's National Cyber Security Centre, called it the most serious vulnerability found in five years, warning it could expose payment-card details and open the door to ransomware. When the foundation cracks, the whole building shakes.
Rows of server racks with blue indicator lights inside a data centre
Why the response was so extreme — and so correct
So the dramatic response was not theatre. Pulling websites offline before the patches arrived was the only safe move for organisations that could not patch instantly, and the experts said so explicitly. The US National Security Agency urged organisations to prepare for immediate updates — and to take systems offline if they could not patch promptly. India's computer emergency response team issued a critical-severity advisory. These are not bodies given to melodrama, and the business fallout of a mass compromise — stolen card data, ransomware, corrupted databases — would have dwarfed the cost of a few dark days.
There is a cold logic to it. With an ordinary breach, responders clean up afterwards: investigate, notify, rebuild. With a flaw like this one, the damage model is inverted — because the attack requires only a single unauthenticated network request, and because the flaw sits in the engine rather than the bodywork, waiting to be attacked first would have been negligent. The cyber event, in the BBC technology editor's memorable phrase, "hasn't happened yet" — but the precautions were the event. Prevention, for once, got the headlines. You can read her full column here.
The detective that found the flaw was an AI
The second revelation is who found the bomb. The flaws were discovered with AI assistance: OpenAI said its GPT-5.6 model identified one of them through its "Patch the Planet" initiative, working with security firm Calif, while the cloud-security company Wiz independently discovered and reported both. OpenAI described it as "one of the most impactful security issues in recent memory" and claimed that, to its knowledge, "frontier AI found these vulnerabilities before attackers did" — a defender's window opened by machines, and a story Verity's technology desk will be watching closely.
That claim, if true, represents a genuine turning point. But windows close. As one cybersecurity executive, Raghu Nandakumara of Illumio, put it: "Speed without control creates a new kind of security problem." The same AI that finds flaws for defenders can analyse freshly published patches for attackers. Cloudflare's chief executive, Matthew Prince, described the escalation in stark terms: thousands of exploitation attempts in the ten hours before the public announcement, tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and millions shortly after. A detailed technical breakdown of the flaws shows why: the patch is a map as well as a fix, and everyone — attacker and defender alike — now reads it at machine speed.
Open source holds the world up, almost alone
The third revelation is the least comfortable. PHP is free, open-source software, maintained by a relatively small community and its foundation — yet it underpins the digital infrastructure of governments, banks and businesses on every continent. The world has been here before, most infamously with the Log4Shell vulnerability in 2021, when another piece of humble open-source plumbing turned out to be load-bearing for the global economy.
The economics of this arrangement are absurd. Trillion-dollar industries and national governments build on code maintained by people who, in many cases, are doing it in their spare time. When the crisis comes, the response is frantic and global — 32 government services switched off, millions of attack attempts — and then everyone goes back to treating the maintainers as an afterthought. Until funding and institutional support for critical open-source infrastructure is treated as a security issue in its own right, we will keep holding our breath over bombs we never paid to defuse.
The uncomfortable question: were we ready?
Credit where it is due: the patch came within roughly a day of the leak, and major operators moved fast. But the record is not entirely reassuring. The coordinated disclosure broke down — details surfaced on a public forum on 20 October, ahead of the planned embargo — and attackers were already probing. Cloudflare detected exploitation attempts in the hours before the public announcement. Amazon's threat-intelligence team said its decoy network spotted an attempt to exploit the flaws on 17 October, days before disclosure, without being able to establish how the suspected attacker learned of them.
And then there is the long tail. Patching is easy if you have a security team; it is a different matter for schools, small councils, charities and the millions of small businesses on shared hosting who may never learn which PHP version they run. Those are the sites that will stay vulnerable for months, quietly exploitable long after the headlines fade. Government warnings reached agencies worldwide — but warnings only help those equipped to act on them.
So was the panic proportionate? Yes — and that is the real story. A week of switched-off government websites and millions of blocked attacks is what a functioning immune system looks like. The question is whether we build on it: fund the open-source foundations, discipline our disclosure processes, and bring the long tail of small operators into the fold. Otherwise, next time the bomb is real, the sirens will sound over a web that is even more fragile than it looks.
