European Websites Taken Offline as Critical PHP Vulnerabilities Trigger Security Response

Government websites and other public-facing services across Europe were taken offline on Wednesday, 21 October, as organisations rushed to address two critical vulnerabilities in PHP, one of the web's most widely used programming languages.

The shutdowns followed warnings from cybersecurity agencies that organisations unable to apply the necessary security updates should consider taking affected websites offline until the vulnerabilities could be addressed.

PHP's development team released fixes for both vulnerabilities on Wednesday, urging users to upgrade immediately. However, reports of emerging attacks raised concerns that organisations running unpatched systems could face further security risks.

Government and Public Services Among Those Affected

The response extended across several European countries, with organisations temporarily restricting access to websites and services while preparing to apply security updates.

In Germany, the federal IT service provider ITZBund took several websites offline as a precaution. German officials said no security incidents were known to have occurred.

France's Interior Ministry temporarily took the websites of local administrative offices offline while awaiting a security fix for the PHP framework they use.

In the Netherlands, affected services included the government portal Overheid.nl, the Port of Rotterdam, the national football association KNVB and websites belonging to the country's five largest political parties. Reuters also reported that several hospital websites were taken offline.

Finland's state IT services provider Valtori shut down public government web services as a precaution, saying it had not identified attempts to exploit the vulnerabilities and that the outage was not caused by a data breach.

The Czech government also took its website offline following a recommendation from the country's cybersecurity watchdog to allow the necessary security updates to be installed.

The Wikimedia Foundation, which operates Wikipedia, said it had taken additional systems offline as a precaution while addressing the vulnerabilities.

The shutdowns demonstrated how a security issue affecting widely deployed software can disrupt public access to government information and other online services, even when an organisation has not confirmed that its own systems have been compromised.

Security Firms Report Emerging Attacks

The website shutdowns came amid warnings that attackers were beginning to exploit the vulnerabilities.

Cloudflare Chief Technology Officer Dane Knecht said the company was observing early attacks and updating its firewall rules to provide temporary protection. He stressed that these measures were not a substitute for applying the official security updates.

The release of security fixes also raised concerns that attackers could analyse the changes to identify how the vulnerabilities worked and develop ways to target systems that remained unpatched.

Reuters reported that cybersecurity researchers were preparing for a potential increase in intrusion attempts as attackers sought to exploit vulnerable servers.

The European Union Computer Emergency Response Team (CERT-EU) and cybersecurity agencies in other countries had urged organisations to prepare for immediate patching. Where organisations could not apply the required fixes, agencies recommended considering temporary shutdowns of affected websites.

AI-Assisted Research Helped Uncover Flaws

The vulnerabilities were also notable because cybersecurity companies reported using artificial intelligence tools during their discovery.

Cybersecurity firm Calif said it had identified the flaws with assistance from a large language model, while Wiz reported using its AI-assisted vulnerability research tools alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

According to Wiz, the vulnerabilities had remained hidden in PHP's codebase for more than a decade, alongside many others, and it prompted a live emergency threat briefing.

The results showed a growing use of AI-assisted tools in security research, including their ability to find vulnerabilities in popular software. But those same capabilities can also give defenders a challenge if attackers use similar techniques to probe for vulnerabilities and develop exploits.

Organisations Under Pressure to Patch Affected Systems

PHP security updates are now available and the development team is urging users to upgrade immediately.

Affected systems organisations need to work out their exposure and apply the appropriate fixes. Until a patch can be applied, cybersecurity agencies have recommended taking affected websites offline while the risks are mitigated.

The situation also underscored how hard it is to deal with flaws in the software that runs so many websites and services. Organisations must balance the risk of exposing potentially vulnerable systems against the need to maintain access to online services.

Security companies are reporting some attacks are emerging but the immediate priority is the application of the relevant updates and whether any affected systems have been compromised.