A flaw lurking unseen in PHP code for years, uncovered with help from artificial intelligence, forced governments across Europe to pull websites offline this week.
The PHP programming language powers a massive share of the web. When its maintainers disclosed critical vulnerabilities and shipped an emergency patch, national agencies and major platforms scrambled to respond before attackers could strike.
PHP developers released the fix on October 21 and urged users to update immediately. Meanwhile, several governments chose to disable public-facing resources entirely as a precaution.
The discovery stands out because AI tools surfaced bugs that human developers had missed for years. That blind spot now affects a huge installed base.
According to W3Techs, PHP runs roughly 75% of websites where server-side language can be identified. Censys adds that about 1.5 million of 2.6 million hosts still report a PHP version with no available patch.
The language, born in the 1990s, underpins WordPress, Drupal, Joomla, and Magento. A critical flaw anywhere in that ecosystem carries global consequences.
As a result, the Netherlands took its national cybersecurity agency site offline. The port of Rotterdam, government portal Overheid.nl, the KNVB football association, political party sites, and hospital systems also went dark.
Finland’s IT provider Valtori disabled public government network services. France shifted Interior Ministry websites into maintenance mode. Denmark’s municipal IT firm Kombit shut down several systems, including a national school communication platform.
Even operators like Wikipedia and the Internet Archive temporarily suspended some services while applying fixes.
