Governments take websites offline as critical PHP flaws prompt global patching effort

Governments and businesses worldwide temporarily took websites and online services offline after researchers disclosed two critical vulnerabilities in PHP, the server-side programming language used by nearly 70% of websites whose underlying technology is known.

The flaws, dubbed “PHP2Shell,” could allow an unauthenticated attacker to run code remotely on vulnerable servers, potentially exposing sensitive information. Researchers used advanced AI models from OpenAI and Google to turn weaknesses that had existed for more than a decade into working attacks. The PHP Foundation released patches on Wednesday, earlier than planned after details began circulating publicly, and urged all PHP operators to update immediately.

European authorities moved quickly to reduce exposure. The Netherlands suspended services including its DigiD identity system and government portals, while Finland, France, Germany and the UK took some public services offline or placed them into maintenance. Britain said Thursday that 32 government services were unavailable and four were partly unavailable, largely because of precautionary work. Nepal also shut government systems temporarily and said some had since returned after patching.

The U.S. National Security Agency and European cybersecurity bodies advised organizations to install updates immediately or disconnect affected servers until they could be secured. The BBC and government officials said there were no confirmed successful breaches, although Amazon Threat Intelligence reported detecting an attempted exploit through its monitoring network. Experts cautioned that evidence of any compromise could take time to emerge.