A wave of takedowns swept through government services across Europe on Wednesday October 21 as cyber agencies warned that websites may be taken offline while PHP prepares a critical fix.
Dutch, French, Danish and Finnish public portals went dark within hours of the disclosure, part of a coordinated scramble that also reached Japan where brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway suspended internet services as a precaution. The disruptions extended to Helsinki, where municipal systems were among those taken offline. A single flaw in PHP opens the same door on millions of servers at once. Whoever exploits the flaw controls the website.
The flaws were uncovered with artificial intelligence
Researchers at security firm Calif reported the first flaw to PHP on August 1 after finding it with OpenAI's GPT-5.6 Sol model, the company said. Alphabet-owned cybersecurity company Wiz independently discovered a second flaw on August 24, using its Wiz Atlas autonomous AI vulnerability research tool as well as Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The underlying defects had been present for decades, Wiz said, but proving they were exploitable required a chain of steps at the edge of what human researchers could practically achieve. US President Donald Trump's administration said it was tracking and coordinating with federal agencies and leading SI labs to expedite the release of the fix, referring to Trump's preferred name for artificial intelligence and framing the discovery as evidence that American Super Intelligence strengthens national security.
The two vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 severity scale, a standard industry scoring system. CERT-EU, the European Union's cybersecurity response team, said that rating signals unauthenticated remote code execution, meaning an attacker can run commands on a vulnerable server, over the internet, with no password or account. A single flaw in PHP opens the same door on millions of servers at once. Whoever exploits the flaw controls the website. GoDaddy, a web hosting provider, said that could mean stolen data, defaced pages or full-system compromise. Cloudflare's chief technology officer said early attacks were emerging.
The web that depends on PHP
PHP runs nearly 70 percent of all websites whose programming language can be identified, according to web technology tracker W3Techs. It is the engine behind WordPress, the software that powers about 40 percent of all websites such as blogs, small business pages, government portals, online shops and news sites. Most small websites are typically run by owners with no security staff, often on shared hosting where they do not manage the server and may not know who updates PHP. Wordfence, a security plugin for WordPress sites, warned that the usual automatic updates will not apply this fix. CERT-EU's guidance is to take affected sites offline rather than leave them exposed.
According to data from Censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.
Governments take decisive action
With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should check whether your live site uses PHP and prepare to apply the new fix. Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied. Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, security researchers said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates. AI was powering a race to exploit, said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the mass compromise of every vulnerable web server on the internet.
The exploitation surge
In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it, Cloudflare CEO Matthew Prince said in a post on X late on Wednesday. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now. Amazon also said it saw widespread exploitation. Japanese companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as part of emergency measures. Microsoft CEO Satya Nadella said at an event in Germany on Thursday, I've not seen anything like this in a long, long time, saying the incident showed the importance of building software that can be maintained securely as systems grow more complex. It was a long day and a long night, I know, for all the IT and security folks.
What remains on the line
The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand. GoDaddy said that could mean stolen data, defaced pages or full-system compromise. CERT-EU's guidance is to take affected sites offline rather than leave them exposed. Even some world leaders weighed in. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should check whether your live site uses PHP and prepare to apply the new fix. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.
The real question is whether patching will hold. Cloudflare's data shows attackers moved faster than defenders in every phase after disclosure. The flaws had lurked for decades before AI tools found them. The patches are public now, but 1.5 million hosts still report running unfixed versions of PHP. That gap between disclosure and remediation is where the next wave will land. Watch for whether patch rates catch up before attackers do.
Read Reuters analysis on the PHP vulnerability
For more on desk coverage, check desk coverage