According to reports, hackers were exploiting the flaws to break into websites. Meanwhile, government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution, officials said [1].
PHP is used as a foundation for large sections of the internet, with experts concerned that many websites could be vulnerable to attack.
According to security researchers, the flaws had gone undetected for more than a decade and were only discovered thanks to artificial intelligence (AI)-assisted analysis, according to the BBC [2].
Cybersecurity firm Wiz described the issue as the "most severe" ever detected [3]. The disclosure set off a global scrambling effort as governments and companies moved to protect their systems.
PHP Vulnerability Disclosure Prompts Security Scramble
On Oct. 20, Tuesday, PHP developers reported that they had identified two critical vulnerabilities and urged users to update their sites once a fix was released [4]. However, reports have found that hackers were already exploiting the flaws; security firms warned that patching needed to happen immediately.
Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said attacks were emerging and that Cloudflare was updating its firewall rules as a stopgap measure [5]. The warning underscored the urgency facing website operators who could not immediately apply the fix.
In a blog post, cybersecurity company Huntress said that PHP powers WordPress, Drupal, Joomla, Magento, shared hosting platforms, and control panels [5].
The breadth of PHP's footprint meant that the vulnerabilities had the potential to affect a vast range of online services.
Scope of Exposure: Millions of Servers Potentially Affected
WordPress, which powers about 43% of all websites, runs on PHP [5]. The fact that so many sites run using a single programming language has raised concerns about the scale of potential exposure.
Security experts have warned that the vulnerabilities could potentially endanger millions of servers because many websites use the same underlying software [5]. That approach is consistent with documented patterns of automated attacks.
Experts have also cautioned that such sites could take longer to patch and remain exposed well after fixes are released [5]. The combination of widespread use and automated exploitation tools made the vulnerabilities especially dangerous.
The Dutch cybersecurity agency also went offline, claiming that it had done so as a precaution because of the vulnerabilities [5].
The disruptions also affected other areas beyond continental Europe.
Agencies Urge Immediate Patching as Fix Is Released
Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. The warning highlighted a gap in responsibility that could leave many sites exposed.
The absence of a public response from CISA left questions about the agency's assessment of the threat [5].
Broader Cybersecurity Concerns and Decentralized Alternatives
The PHP incident is the latest in a series of cybersecurity failures affecting governments, corporations, and infrastructure. These incidents illustrate a pattern of vulnerability in centralized systems.
Critics of centralized digital infrastructure argue that the repeated failures demonstrate the risks of concentrating data and services in a few hands. The repeated exposure of sensitive information through government and corporate systems has fueled calls for decentralization and open-source alternatives.
Decentralized systems, by contrast, distribute risk and reduce single points of failure.
References
- Government websites go dark after AI-discovered flaw .... https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/
- What is PHP and why did it spark a global cyber-security scramble?. https://bbc.com/news/articles/c3qjnwye0ep5o
- How did AI discover the internet's massive cyber-security risk?. https://bbc.com/news/videos/cq0ld7e0jg2eo
- Government websites go dark as software flaw sparks security scramble .... https://threatbeat.com/attacks-and-incidents/government-websites-go-dark-as-software-flaw-sparks-security-scramble/
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble. https://www.cnbc.com/2026/10/21/government-websites-go-dark-as-software-flaw-sparks-security-scramble.html
Please contact us for more information.
