Government agencies around Europe and elsewhere shut down websites on Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.
Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live, and acknowledged a delay in addressing a previously identified flaw. NSA will follow up shortly with more specific guidance,” it said in a post on X. “If you run PHP, it is imperative that you update now,” it added.
The US National Security Agency urged organisations using the software to install the updates immediately or take vulnerable systems offline.
The PHP Foundation, which oversees development and maintenance of the software, addressed the flaws as a “structural failure” and said that these releases fix two critical vulnerabilities that, under the right conditions, could allow an unauthenticated attacker to execute code on servers running PHP.
Belgium’s foreign ministry also took its websites offline temporarily as a precaution, according to a post on X. However, the country’s Centre for Cybersecurity said it had not detected any attacks on Belgian websites. (With inputs from AFP)
A security researcher first identified signs of one of the vulnerabilities in 2024, but that the issue was “theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns. The PHP Foundation later enrolled the PHP project in the Patch the Planet programme, under which security firm Calif began an audit of PHP on July 30, 2026. In August, Calif and OpenAI, the company behind ChatGPT, independently reported the flaws on the same day. The vulnerabilities were privately reported to PHP’s developers and kept confidential while a fix was being prepared. In the Netherlands, authorities temporarily shut down the DigiD digital identity service, the House of Representatives website and the national cybersecurity centre’s site as a precaution, Dutch broadcaster NOS reported.
“Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. Google-owned cloud security firm Wiz later identified additional ways to exploit them.
OpenAI in a post on X said that its models helped researchers discover critical security flaws in PHP. It called the bug one of the most “impactful vulnerabilities” in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact,” it said. In France, several local government websites, including that of the Paris Police Prefecture, were taken offline from Wednesday afternoon at the request of the French National Cybersecurity Agency after a critical security flaw was detected, the Interior Ministry said.
