Government Websites

Government websites and other public-facing online services across several countries were temporarily taken offline after researchers uncovered two critical security vulnerabilities in PHP, a programming language widely used to operate websites and web applications. The discovery triggered an international cybersecurity response, with authorities urging administrators to install emergency updates or isolate vulnerable systems until they could be secured.

The vulnerabilities, identified with the assistance of artificial intelligence tools, had remained hidden in PHP for years. Their disclosure raised concerns that attackers could use the newly available technical information to target unpatched servers, potentially putting websites, business systems and sensitive information at risk.

The incident highlights a growing challenge for cybersecurity teams: artificial intelligence can help researchers discover dangerous software weaknesses, but the same technology can also help malicious actors understand and exploit them.

Government Websites Taken Offline as a Precaution

Organisations in several European countries moved to restrict access to public-facing services while security teams assessed their exposure and prepared updates.

In the Netherlands, affected services included government websites and other public platforms. Finland also experienced significant disruption to government network services, while France's Interior Ministry placed its websites into preventive maintenance. Danish municipal IT services were among those that suspended certain online functions.

The response was not limited to government institutions. Wikipedia's operator reported taking some systems offline while security work was carried out. Other organisations also assessed whether their infrastructure needed immediate protection.

Taking a website offline does not necessarily mean it has been hacked. In this case, the shutdowns were precautionary measures intended to reduce exposure while operators determined whether their systems were vulnerable and applied the necessary fixes.

For public institutions, however, even a temporary shutdown can affect access to information and online services. Citizens may be unable to use digital portals, while organisations relying on connected platforms could experience delays until services are restored.

What Is the PHP Vulnerability?

PHP is an open-source programming language commonly used to build and operate websites. It works on the server side, helping generate web pages, process requests and connect applications to databases.

The technology is used across a substantial portion of the internet, including websites built with popular content-management systems and online publishing platforms. This broad presence means a serious weakness in PHP can have consequences far beyond a single company or government department.

On October 21, PHP's development team released security updates addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. The flaws were rated 9.2 on the CVSS version 4.0 severity scale, placing them in the critical category.

According to the PHP team's security advisory, the vulnerabilities could allow remote code execution without authentication. In practical terms, a successful attack could enable an unauthorised party to make a vulnerable server execute malicious instructions without first logging in.

The precise consequences would depend on the affected system, its configuration and the access available to the compromised service. Potential risks include unauthorised access, service disruption and further attempts to compromise connected systems.

The PHP team urged users to update immediately, warning that there were no complete substitutes for installing the security fixes.

How Artificial Intelligence Helped Find the Flaws

The vulnerabilities were discovered during a coordinated research effort involving cybersecurity researchers and technology companies. AI-assisted analysis helped researchers examine complex software code and identify weaknesses that might otherwise have required extensive manual investigation.

OpenAI said its Patch the Planet initiative brought together software maintainers, researchers and security providers to investigate and address critical PHP vulnerabilities. The company said Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. The PHP maintainers led the work to prepare and release fixes.

The discovery demonstrates how AI can strengthen digital security by helping researchers analyse large codebases and identify flaws more efficiently. But it also exposes a serious risk: once technical details become public, attackers may use AI to understand the weaknesses and develop methods to exploit systems that have not yet been updated.

This creates a narrow window for defenders. Organisations must identify vulnerable systems, test and install fixes, and check for suspicious activity before attackers can take advantage of the disclosure.

Why the Risk Extends Beyond Governments

The incident could affect any organisation running a vulnerable PHP installation, depending on its software version and server configuration. Government departments are particularly visible targets, but businesses, publishers, charities and smaller website operators may also face exposure.

Smaller organisations could encounter greater difficulties because they may lack dedicated security teams, maintain outdated software or rely on hosting providers to manage server infrastructure. Even when a patch is available, administrators must know which systems are affected and ensure that updates are applied correctly.

Websites built on platforms such as WordPress, Drupal, Joomla and Magento may use PHP, but the presence of one of these platforms alone does not establish that a particular site is vulnerable. The actual risk depends on the PHP installation, the hosting environment and whether the relevant security updates have been applied.

Organisations should therefore avoid assuming that a site is safe simply because it remains online or has not shown obvious signs of compromise.

What Website Operators Need to Do

Security teams should identify every PHP environment they operate, including production servers, legacy applications and systems managed by external hosting companies. They should then install the appropriate supported security release, following official PHP and hosting-provider instructions.

Administrators should also review server logs for suspicious requests, investigate signs of unauthorised activity and verify that backups and recovery procedures are working. If a vulnerable system cannot be updated promptly, restricting public access or temporarily taking it offline may reduce exposure while remediation takes place.

Installing a patch is essential, but it does not automatically prove that a server was never compromised. Systems that may have been exposed should be assessed for evidence of intrusion, with additional response measures taken where necessary.

Users who operate websites through a hosting provider should contact the provider to confirm whether the relevant updates have been applied.

A Warning About the Future of Cybersecurity

The PHP incident illustrates both the promise and the danger of AI-assisted security research. Faster discovery can help developers fix weaknesses before they lead to widespread damage, but public disclosure can also accelerate the race between defenders and attackers.

For governments, businesses and everyday internet users, the wider lesson is that software maintenance is a core part of digital security. Prompt patching, monitoring and coordinated incident response are increasingly important as AI makes it easier to analyse complex vulnerabilities.

The immediate priority is to secure affected systems and restore services safely. The longer-term challenge will be ensuring that organisations can respond quickly when new vulnerabilities emerge in software used across the global internet.