European governments take websites offline over critical PHP flaws
Because PHP underpins many public websites, one remotely exploitable flaw can interrupt government services across borders without any confirmed breach.
Overview
Public websites across Europe briefly went offline after researchers using AI-assisted methods found two critical flaws. The flaws could let anyone run code remotely on exposed servers. runs many government, hospital, school and business websites, turning one weakness into a cross-border problem. released emergency fixes and urged immediate updates. The FBI and other agencies told operators to patch systems or isolate those they could not update. The Netherlands took its cybersecurity agency, and other public services offline. Finland’s disconnected government web services, while France put ministry and local-government sites into preventive maintenance. These shutdowns were precautions, not proof of hacking or stolen data. Services could return after patching and checks, but the incident showed the risks of shared software and increased pressure to track dependencies, improve monitoring and strengthen .
Timeline
PHP emergency release provides patches for two critical vulnerabilities
PHP released for after two critical vulnerabilities were disclosed. Organizations that had taken services offline could restore them after applying the updates or otherwise protecting affected systems.
Authorities distinguish precautionary shutdowns from confirmed PHP breaches
Reports described the response as a precaution against possible exploitation of the remote-code-execution flaws. The available reporting did not establish that the affected government systems had been compromised or that data had been exfiltrated, separating exploitation warnings from confirmed intrusions.
Other European operators suspend public services while assessing the PHP exposure
Operators in Denmark, Belgium and other countries also restricted or suspended selected services, including a national school communications platform and university systems. The spread reflected ’s broad deployment across government, education and private infrastructure.
France’s Interior Ministry places administrative websites into preventive maintenance
France’s Interior Ministry placed its websites into , affecting public-facing administrative and local-government services. The measure followed the same patch-or-isolate approach used in the Netherlands and Finland.
Finland’s Valtori disconnects government public web services before patching
Finland’s state IT provider took government public network services offline as a precaution. The action was described as while agencies prepared updates, not as confirmation that government data had been stolen or systems breached.
Dutch authorities take exposed public websites offline as a precaution
The took its own website offline while operators assessed the PHP risk. Other Dutch services, including , government portals, the Port of Rotterdam, political-party websites and some hospital sites, were also reported offline or restricted.
PHP maintainers release emergency fixes and urge operators to update immediately
The PHP team issued fixes for after the vulnerabilities were disclosed. urged operators to install the updates immediately or restrict access to exposed systems until patching was complete.
Researchers report that the PHP flaws enable unauthenticated remote code execution
The flaws, later tracked as , could allow an attacker to execute arbitrary code remotely without logging in. One involved during out-of-memory handling, while the other involved stale internal global state after memory was released.
Security researchers using AI identify two critical PHP vulnerabilities
Calif and Google-owned Wiz independently identified two critical vulnerabilities using . The flaws affected systems processing web requests and were disclosed after patches had been prepared.