Governments take websites offline after critical PHP flaws disclosed
publishers 65articles 84first reported 21 Oct, 02:12 UTCdeveloping since 21 Oct · 10 editions
Governments and businesses worldwide temporarily shut websites and digital services after researchers disclosed two critical vulnerabilities in PHP, the server-side programming language used by roughly 70% of websites with a known back-end language.
The flaws, known collectively as PHP2Shell, could allow an unauthenticated attacker to execute code remotely on an unpatched PHP server, potentially exposing sensitive data. Researchers used advanced AI systems from OpenAI and Google to develop working attacks from weaknesses that had remained in PHP code for more than a decade.
The PHP Foundation released patches on Wednesday, earlier than planned after details began circulating online, and urged operators to update immediately. U.S. and European cybersecurity authorities advised organizations to patch internet-facing systems or take them offline until updates could be applied.
Precautionary shutdowns affected government services across Europe. The Netherlands suspended its DigiD identity service and several public portals, while Finland, France, Germany and the United Kingdom restricted some online services. British officials said Thursday that 32 government services were unavailable and four were partly unavailable, but no major public-facing critical services had been affected.
Thousands of government and banking websites were also suspended in Nepal, including Nepal Rastra Bank’s website and the Vehicle Consignment Tracking System. Authorities said services would return after security updates and audits.
Officials and researchers had reported no confirmed successful breaches as of Thursday, although Amazon Threat Intelligence said it detected an attempted exploit before public disclosure. Security specialists warned that AI tools could help both defenders identify vulnerabilities and attackers develop exploits more quickly.
HOW THIS STORY WAS MADE
Written from 8 articles, 6 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 96 h after the record first saw the story; the editor kept it as written.
- Publishers
- 65
- Source articles
- 84
- Given to the writer
- 8, 6 with the article's own text
- Independent newsrooms
- 8
- This version written
- 96 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →