Government agencies around Europe and elsewhere shut down websites on Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.
However, the country’s Centre for Cybersecurity said it had not detected any attacks on Belgian websites. (With inputs from AFP) Earlier reporting noted: Cyber agency warns websites may go dark as PHP prepares critical fix The developers of the widely used PHP programming language said on Wednesday (October 21, 2026) they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline. “Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. In the Netherlands, authorities temporarily shut down the DigiD digital identity service, the House of Representatives website and the national cybersecurity centre’s site as a precaution, Dutch broadcaster NOS reported.
Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw. It also marks a new phase, where AI can find security bugs with internet-scale impact,” it said. In France, several local government websites, including that of the Paris Police Prefecture, were taken offline from Wednesday afternoon at the request of the French National Cybersecurity Agency after a critical security flaw was detected, the Interior Ministry said. Belgium’s foreign ministry also took its websites offline temporarily as a precaution, according to a post on X. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.
The US National Security Agency urged organisations using the software to install the updates immediately or take vulnerable systems offline.
Earlier reporting noted: PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions. Earlier reporting noted: “PHP is everywhere.
How were the flaws found?
A security researcher first identified signs of one of the vulnerabilities in 2024, but that the issue was “theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns. The PHP Foundation later enrolled the PHP project in the Patch the Planet programme, under which security firm Calif began an audit of PHP on July 30, 2026. In August, Calif and OpenAI, the company behind ChatGPT, independently reported the flaws on the same day. The vulnerabilities were privately reported to PHP’s developers and kept confidential while a fix was being prepared.
NSA will follow up shortly with more specific guidance,” it said in a post on X. The PHP Foundation, which oversees development and maintenance of the software, addressed the flaws as a “structural failure” and said that these releases fix two critical vulnerabilities that, under the right conditions, could allow an unauthenticated attacker to execute code on servers running PHP. “If you run PHP, it is imperative that you update now,” it added. OpenAI in a post on X said that its models helped researchers discover critical security flaws in PHP. It called the bug one of the most “impactful vulnerabilities” in recent memory.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. Google-owned cloud security firm Wiz later identified additional ways to exploit them.
