Government and enterprise websites pulled offline over critical PHP flaws
Governments and private organizations across Europe, Asia, and North America have taken public-facing websites and digital services offline following the discovery of two critical vulnerabilities in the widely used programming language PHP.
Two critical security flaws in PHP, the server-side programming language underpinning a vast portion of the internet, have triggered an international cybersecurity scramble. Discovered with the assistance of artificial intelligence, the vulnerabilities—dubbed PHP2Shell—allow unauthenticated remote code execution and carry high severity ratings. The exposure prompted cybersecurity agencies across Europe, the United States, the United Kingdom, and Australia to urge operators to rapidly deploy patches or temporarily shut down exposed systems.[11][3][12][8]
Precautionary shutdowns quickly swept across European public infrastructure. Governments in Finland, the Netherlands, and France took portals offline, with the Dutch parliament and the Dutch cybersecurity agency pulling their own websites. In addition to government portals, European schools and hospitals took services offline, while access to parts of Wikipedia was disrupted when Wikimedia disabled affected systems. Sites in Denmark, Germany, and Belgium were also taken down, and North Korean state media and government web services experienced extended outages.[10][1][13][9]
The fallout rapidly expanded to the private sector and into Asia. In Japan, banks, airlines, and several ministries pulled digital services and web pages offline following late-night advisories. Simultaneously, internet infrastructure providers observed a massive surge in hostile activity. Cloudflare chief executive Matthew Prince reported that exploit attempts jumped from thousands prior to the announcement to millions within hours, while CrowdStrike warned that exploitation attempts leave virtually no trace.[2][14][3][9]
Key facts
- Two critical security flaws in PHP, dubbed PHP2Shell and rated 9.2 out of 10 for severity, enabled remote code execution without authentication.
- The vulnerabilities were discovered using AI, with security firm Wiz calling them the most severe vulnerabilities ever uncovered by AI technology.
- Governments across Europe and North America took websites offline, including agencies in Finland, the Netherlands, France, Germany, Denmark, Belgium, and Canada.
- The Dutch national cybersecurity agency and the Dutch parliament took their own web portals offline as a precaution.
- European hospital and school websites were taken down, and Wikimedia disabled systems, causing access disruptions to parts of Wikipedia.
- Cloudflare reported that exploit attempts jumped from thousands before disclosure to millions within hours.
- Japanese banks, airlines, and government ministries pulled digital services and web pages offline after urgent warnings to patch or unplug.
Sources · 12 sources
- TE
TechmemeArticle ·
Several government, school, and hospital websites in Europe were taken offline as organizations rush to protect themselves from two critical PHP security flaws (Reuters) Reuters : Several government, school, and hospital websites in Europe were taken offline as organizations rush to protect themselves from two critical PHP security flaws — Several government, school and hospital websites in Europe were taken offline on Wednesday as organizations rushed to protect themselves …
Open source - TS
The Straits Times@straits_timesPost on X ·
Japan’s banks and airlines pull digital services offline in scramble to fix PHP flaws https://t.co/tNs30soYq0
Open source - CB
Coin Bureau@coinbureauPost on X ·
The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.
Open source - RE
Reuters@ReutersPost on X ·
Some government websites in Europe and elsewhere went offline after vulnerabilities in PHP, a widely used programming language, were uncovered using AI. Cybersecurity Reporter Raphael Satter explains why https://t.co/5Z2k5mTOnH https://t.co/YuVKHrdJMw
Open source - EN
Engadget@engadgetPost on X ·
All websites using PHP should update to the latest security patch. https://t.co/3A9pyJnM7m
Open source - ET
Economic Times@EconomicTimesPost on X ·
What are the #PHP security vulnerabilities: Bugs discovered by #GPT-5.6 Sol and Wiz Atlas that made #govts take websites offline 🔗 https://t.co/9XVlw5PYAT https://t.co/4hJNR1wwps
Open source - BL
Bloomberg@businessPost on X ·
Japanese companies from banks to airlines took down digital services to shield themselves from flaws in internet software https://t.co/A02toqS9Eu
Open source - BU
businessline@businesslinePost on X ·
Two security flaws in PHP, the programming language that underpins millions of websites, have triggered a global cybersecurity response. The US is coordinating remedial efforts, while several European governments have taken public-facing websites offline. https://t.co/e2ktWF2jAJ
Open source - PR
ProtosArticle ·
North Korean sites go dark while PHP flaw sparks global panic North Korean government and state media websites have been offline for 24 hours following the disclosure of a major PHP vulnerability that left 70% of the world’s websites open to hackers. PHP, the scripting language powering these websites, was discovered to have a major bug that could allow hackers to execute code remotely. This discovery led to a global panic and resulted in companies and governments across the globe shutting down their sites as they attempt to fix the problem. Countries carrying out these shutdowns include the Netherlands, France, Finland, Denmark, Germany , Belgium , Australia , and North Korea. Internet analysts NetBlocks also logged an “ongoing disruption” to North Korea’s internet during the panic while claiming international users are unable to access the country’s .kp domain. Confirmed: Network data show an ongoing disruption to North Korea's already limited internet connectivity. The incident corresponds with the loss of international access to websites under the country's .kp domain. pic.twitter.com/7QXIN3PF9Q — NetBlocks (@netblocks) October 21, 2026 Read more: AI firm ORO says North Korean hacker stole $600K worth of crypto PHP incident causes exploits to rise Cloudflare co-founder Matthew Prince revealed that in the 10 hours leading up to the public disclosure of the vulnerability, Cloudflare witnessed “thousands of attempts to exploit it.” He warned, “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.” Crypto exchange Binance ups security The world’s largest crypto exchange Binance claims it has implemented safeguards ahead of the release of an official patch that will mitigate the ongoing PHP security vulnerability. Co-founder Changpeng Zhao warned users to be “extra careful” when visiting websites as “some web admins are not always up-to-date with security patches.” Executive Director of Growth for Binance’s BNB Chain, Nina Rong, clarified that BNB Chain “does not use PHP in our tech stack.” BNB Chain’s tech stack does not use PHP. Our network and core infrastructure are unaffected by the PHP2Shell vulnerabilities. We remind the community to be extra vigilant and stay SAFU at all times. — BNB Chain (@BNBCHAIN) October 22, 2026 Read more: Remotely exploitable PHP bug found on 70% of world’s websites Crypto exchange MEXC and crypto wallet Trust Wallet also claim they’ve not been affected by the vulnerability since neither firm uses PHP infrastructure. MEXC added that third parties employed by the firm that do use it “have completed the necessary fixes.” Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post North Korean sites go dark while PHP flaw sparks global panic appeared first on Protos .
Open source - BT
Bull Theory@BullTheoryioPost on X ·
BREAKING: Governments in Europe are shutting down their websites because of critical flaws in PHP, the language behind millions of websites. Finland, the Netherlands and France have taken government websites offline, including the Dutch cybersecurity agency's own site. https://t.co/pB9VNatHi9
Open source - UW
unusual_whales@unusual_whalesPost on X ·
BREAKING: Two critical security flaws in PHP, the programming language behind much of the internet, are forcing governments to take websites offline, per the BBC. The flaws were found by AI. Security firm Wiz called them the “most severe vulnerabilities ever discovered” by the technology.
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
🇪🇺🇳🇱🇫🇮 European government sites GO DARK amid CYBER THREAT... Government websites in the Netherlands and Finland were taken offline after reports that hackers were exploiting critical flaws in PHP, a programming language used across the web. Cybersecurity agencies in Europe, the UK, and Australia urged operators to patch vulnerable systems or take sites offline. Even the Dutch cybersecurity agency pulled its own website as a precaution. 1 SOFTWARE FLAW is enough to spook multiple governments off the web. It’s that simple. Source: Reuters / Writer: Marie
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
🚨Two CRITICAL PHP flaws forced Wikipedia and government sites offline. The bugs went undetected for over 10 years until AI helped uncover them. A fix was released, but agencies were told to shut down systems they couldn’t patch fast enough. Finland took government services offline, Dutch agencies and parliament went dark, and Wikimedia pulled some systems, disrupting access to parts of Wikipedia. When a flaw threatens code powering so much of the web, sometimes the safest move is to unplug. Source: BBC, Reuters / Lucas
Open source - MN
Mario Nawfal@MarioNawfalPost on X ·
PHP powers much of the web, and two critical flaws just forced governments to tell sites to patch or go offline. The bugs allow remote code execution without login. AI helped researchers uncover flaws that had gone undetected for years. Japan issued a late-night warning, and some ministries and banks took pages down. No major breaches are confirmed. Meanwhile, an Indian certificate company used keys as weak as the number 4, and GitLab disclosed a perfect 10.0 vulnerability dating back to 2014. The internet keeps proving how fragile it is. Writer: Lucas https://t.co/mLwwcHO9vj
Open source