On Wednesday, something unusual happened across Europe. Government websites that millions of people rely on to file paperwork, check records and read official notices simply disappeared. The Dutch government portal went dark. France’s Interior Ministry put every one of its websites into maintenance.
In Finland and Denmark, state IT providers switched off public services. Some Canadian federal websites soon followed.
There was no attack on any single government, no ransom demand and no hacker group claiming credit.
The cause was a pair of bugs in PHP, a piece of software most people have never heard of but which quietly runs a huge share of the internet. Here is what happened, and why it matters.
What is PHP?
PHP is a programming language built for websites, and it works out of sight. When someone opens a web page, the server uses PHP to pull together the text, images and data, then sends the finished page to the visitor’s browser.
It is free, open source and looked after largely by volunteers, and it has been around since the mid-1990s. Most website owners never touch it directly. They use tools built on top of it, such as WordPress, Drupal, Joomla and Magento.
That is why its reach is so vast. According to web technology tracker W3Techs, PHP runs nearly 70% of all websites whose server-side language can be identified.
The PHP team released emergency fixes on 21 October for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619.
Some researchers have nicknamed the pair PHP2Shell. Each scores 9.2 out of 10 on CVSS v4.0, the industry’s standard yardstick for how dangerous a security bug is.
The score reflects what the flaws allow. CERT-EU, the European Union’s cybersecurity response team, said they enable unauthenticated remote code execution.
In plain terms, an attacker anywhere on the internet can make a vulnerable server run their commands without needing a password or an account.
Once that happens, the attacker effectively controls the website. Web hosting company GoDaddy warned the result could be stolen data, defaced pages or a full takeover of the system.
Crucially, the weakness sits inside PHP itself rather than in any one website’s code. Researchers have stressed that even a well-built website can be exposed simply because it runs on an affected version. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why did governments switch their websites off?
Because there was no safe middle ground. PHP’s developers said there was no complete workaround short of updating. CERT-EU advised organisations that could not patch straight away to take affected websites offline rather than leave them exposed.
Cyber agencies in Britain, Australia, Japan and Canada issued similar warnings.
Patching is rarely instant for public bodies, which often run dozens of linked systems that must be tested before any update goes live. Pulling the plug for a few hours was the cautious choice.
In the Netherlands, the National Cyber Security Centre took its own website down, as did the Port of Rotterdam, the government portal Overheid.nl, the national football association, the five largest political parties and several hospitals.
Canada’s AI minister Evan Solomon called the federal shutdowns a precautionary step, while Japan’s prime minister Sanae Takaichi urged operators to check whether they used PHP.
Beyond government, the organisation that runs Wikipedia disabled some of its systems, and the Internet Archive briefly went offline.
How were the flaws found?
This is what makes the episode a landmark. Both flaws were found with the help of artificial intelligence (AI).
Security firm Calif, working with OpenAI, says it spotted the first flaw on August 1 using a large language model and reported it to the PHP team on August 11.
Wiz, the Google-owned security company, found the flaws independently using its own AI research system alongside models from Google and OpenAI, and reported a second bug on August 24.
The bugs had been hiding in PHP’s code for well over a decade. Wiz said proving they could actually be exploited took a chain of steps at the very limit of what human researchers could manage.
Its verdict was blunt, placing the pair among the most severe flaws ever found in PHP and “arguably in software history”.
For about two months, the researchers and the PHP team worked quietly on fixes, a standard practice known as coordinated disclosure that aims to have patches ready before criminals learn the details.
Yes, although accounts differ on how widely. Amazon’s security chief CJ Moses said the company’s decoy “honeypot” servers recorded an exploitation attempt on October 17, four days before the public disclosure.
How the attacker learnt of the flaws is unclear. On October 20, the bug identifiers leaked on online forums, and the release was brought forward by a day.
By Wednesday, Cloudflare said early attacks were emerging, and Amazon later described the flaws as broadly exploited.
The US Cybersecurity and Infrastructure Security Agency and Canada’s national cyber centre, however, said in their first alerts that they had not yet seen any exploitation.
The contest is now about speed. Costin Raiu, co-founder of research firm TLP, told Reuters that AI is accelerating a race to exploit such flaws.
Lukasz Olejnik of King’s College London warned that attacks could spread rapidly across servers that have not yet been updated.
Large organisations with security teams can move fast. The real worry is the long tail of small websites.
Many are run by owners with no technical staff, often on shared hosting where someone else manages the server.
Wordfence, which makes a popular security plugin for WordPress, warned that WordPress’s usual automatic updates will not apply this fix, because the flaw lives in the server software underneath.
Old software makes matters worse.
Internet scanning firm Censys found that about 1.5 million of the 2.6 million PHP servers it detected were running versions for which no fix was available, typically older releases that no longer receive support.
For those, the only real answer is to upgrade.
What does it mean for the rest of us?
Ordinary internet users can do little beyond watching for odd behaviour on familiar websites and for scam emails exploiting the confusion.
For anyone who runs a website, the advice is simple. Check which version of PHP is running, ask the hosting company whether it has been updated and, if in doubt, upgrade.
The wider lesson concerns AI. The same tools that helped defenders find these flaws before criminals did can also help attackers find the next ones.
The Trump administration hailed the discovery as proof that American AI strengthens national security, but security experts note that AI is also shrinking the gap between a bug becoming known and being exploited.
Wednesday’s blackout showed how much of public life rests on volunteer-maintained code that few people ever see. It will not be the last time that foundation is tested.