Critical PHP Flaws Force Government Websites Offline Worldwide in Major Cybersecurity Scramble

Government and public-service websites across multiple countries went dark on Wednesday as operators raced to contain two critical vulnerabilities in PHP, one of the most widely used programming languages on the internet. PHP powers an estimated large majority of websites, including many government portals, hospital systems, university sites, and platforms built on WordPress, Drupal, and similar tools. Developers disclosed the two flaws and released patched versions (including PHP 8.5.12 and related updates). Until sites could be updated, national cyber agencies recommended taking vulnerable systems offline. Many did so as a precaution even before confirmed widespread exploitation. Cloudflare reported seeing early attacks and began updating firewall rules as a temporary measure. Australia’s signals directorate said it was not aware of active exploitation on its systems at the time of initial statements. The U.S. National Security Agency posted that the flaws could provide a direct path to a server’s file system or database and advised organizations unable to patch immediately to take affected systems offline. Where Sites Came Down The Netherlands saw some of the broadest action. Its National Cyber Security Centre took its own site offline, and others followed: the Port of Rotterdam, the government portal Overheid.nl, the national digital identity service DigiD, the House of Representatives site, the national soccer association, websites of the five largest political parties, and numerous hospital sites. Finland’s state IT provider Valtori shut government public network services as a precaution. Germany’s federal IT service provider took several sites offline; officials described the step as preventive with no known incidents. France pulled local government and prefecture sites, including the Paris police prefecture, at the request of its cybersecurity agency. Belgium’s foreign ministry temporarily took sites down. In the United Kingdom, multiple council websites (Edinburgh, Bristol, Oxford and others), the Metropolitan Police site, and additional public pages went offline. Canada pulled an undisclosed number of federal pages for urgent maintenance. Australia’s cyber.gov.au and other government sites were affected. Wikipedia’s operator took supporting systems offline until they could be patched. Additional reports mentioned disruptions in Denmark, the Czech Republic, and elsewhere. Most operators stated that the takedowns were precautionary and that no successful breaches of their specific systems had been confirmed at the time of the announcements. The speed of the response reflected both the severity rating of the flaws (remote code execution potential without authentication in vulnerable configurations) and the breadth of PHP deployment. What the Vulnerabilities Allow The issues, tracked under CVE identifiers including CVE-2026-109618 and CVE-2026-109619 in early notices, affect a wide range of PHP versions. In vulnerable setups they can allow unauthenticated remote code execution, giving an attacker a path to the underlying server. Because PHP is embedded in so many content-management systems and custom applications, the attack surface is large. National agencies in Europe, the UK, the United States, Australia, and Japan issued parallel advice: patch immediately or isolate the systems. The PHP development team released the fixes and strongly encouraged immediate updates. CERT-EU and other coordination bodies amplified the warning that organizations unable to apply patches quickly should consider taking sites offline. The discovery process itself drew attention. Multiple reports noted that the flaws were identified with the assistance of AI-driven analysis, prompting commentary that automated tools are accelerating both the finding of long-standing issues and the pressure on defenders to respond. Whether the specific bugs had been latent for years or were newly introduced is secondary to the operational fact that, once public, the window for exploitation opened quickly. Why So Many Governments Chose Offline A government portal, a hospital booking system, or a digital-identity service that remains reachable while unpatched is an attractive target. Taking the site offline removes the immediate attack path at the cost of temporary public access. For high-value targets the calculation favored availability loss over residual risk. The Dutch cyber agency’s decision to take its own site down set an example that others followed. Similar logic applied in Finland, where the entire public government web presence was pulled. In countries with more decentralized web estates, the response was patchwork—some councils offline, others still reachable while their teams applied updates. The episode illustrates both the concentration risk of a single widely used language and the improved coordination among national cyber centers. Parallel advisories from the NSA, the UK NCSC, CERT-EU, and counterparts in Australia and Japan appeared within hours of one another. The result was a synchronized, if disruptive, defensive action rather than a staggered set of individual compromises. What Remains at Risk Any PHP-based site that has not yet applied the updates remains exposed. That includes smaller government pages, local services, universities, nonprofits, and the large population of WordPress and similar installations that rely on hosting providers to push the patch. Hosting companies and CMS vendors began rolling out updates, but the long tail of self-managed or lightly maintained sites will take longer. Early attack reports from Cloudflare indicate that opportunistic scanning and exploitation attempts started as soon as the details circulated. Organizations that cannot patch promptly are still being advised to restrict access or take systems offline until they can. What to Watch Confirmation of successful compromises versus purely precautionary takedowns. The pace at which major hosting providers and CMS platforms complete their rollouts. Any follow-on advisories about related flaws or incomplete mitigations. Whether the AI-assisted discovery method becomes a more regular part of vulnerability research. Restoration timelines for the largest government portals. Critical flaws in PHP prompted government websites and other public services around the world to go offline on October 21 while operators applied emergency patches. Agencies in the Netherlands, Finland, Germany, France, the United Kingdom, Canada, Australia and elsewhere took the step as a precaution. Early attack activity was reported. The language underpins a large share of the web, so the scramble was broad. Most sites are expected to return once updates are confirmed. The residual risk sits with those that have not yet patched.