Governments and firms in Europe and Japan take sites offline over two critical PHP flaws
In short
After PHP developers announced two critical vulnerabilities on 20 October, government bodies and other organisations in Europe and Japan switched off websites as a precaution. TASS reported shutdowns of state sites in 13 countries, and a fixed PHP version was released on 21 October.
Read the full story 2 min read
Government bodies, city administrations and other institutions in Europe switched off websites as a precaution after the developers of the PHP programming language announced two critical vulnerabilities, Meduza reported. Kommersant said the developers announced the flaws on 20 October, that the flaws could ease hacker attacks, and that hackers had already used them. A day later the developers released an update that fixed the problems and urged users to install it. [ 2 , 5 ]
According to Meduza, the shutdowns came amid reports that hackers were using the flaws to break into sites. Government bodies in the Netherlands, Denmark and Finland, Edinburgh city council and the BBC were among those that took sites offline, and the TV channel Dozhd said it had also done so as a precaution. TASS reported that state sites were switched off in 13 countries, and that the Netherlands, Finland and Belgium were the first to report it. [ 2 , 7 ]
Kommersant reported that France's interior ministry said it had switched off prefecture sites, Germany's government IT service provider ITZBund said some state sites were offline, and Belgium's foreign ministry also took its site down. TASS, citing the Slovak outlet Dennik N, reported that Slovakia switched off state sites on a recommendation from its National Cybersecurity Authority. On 22 October TASS added that some sections and services on the Japanese finance and health ministry sites were unavailable for a time. [ 4 , 5 , 8 ]
Kommersant said CERT-EU, which provides IT services to EU institutions, advised that sites that cannot be updated quickly should be disconnected until the update is installed. The US National Security Agency also urged users to update or temporarily disconnect sites that use PHP, and regulators in other countries issued similar warnings, the paper said. [ 5 ]
Kommersant reported that the vulnerabilities were found by Wiz, a cybersecurity company owned by Alphabet. It said Wiz used AI tools, both its own and Google Gemini 4 Argon and OpenAI GPT-5.6 Sol, and estimated that the flaws affect 70% of the internet because PHP is so widely used. RBC named Wiz and an AI system in the Patch the Planet effort as the source of the discovery, and a TASS item said a team of developers and researchers spent two months finding and fixing the flaws with the help of a GPT model. [ 3 , 5 , 6 ]
Why it matters
Russian outlets report that many public-sector sites were switched off at once, which shows how widely PHP is used. Kommersant cited an estimate by Wiz that the flaws affect 70% of the internet, and said the US National Security Agency and CERT-EU advised updating or disconnecting affected sites.
Key facts
- PHP developers reported two critical vulnerabilities on 20 October and announced a fixed version a day later. [ 2 , 5 ]
- Kommersant reported that hackers had already used the vulnerabilities. [ 5 ]
- TASS reported that state sites were switched off in 13 countries, with the Netherlands, Finland and Belgium the first to report it. [ 7 ]
- Government bodies in the Netherlands, Denmark and Finland, Edinburgh city council and the BBC took sites offline as a precaution, Meduza reported. [ 2 ]
- Slovakia switched off state sites on a recommendation from its National Cybersecurity Authority, according to Dennik N as cited by TASS. [ 4 ]
- Some sections and services of Japan's finance and health ministry sites were unavailable for a time, TASS reported. [ 8 ]
- Wiz found the vulnerabilities using AI tools, Kommersant reported. [ 5 ]
Confirmed by several sources
- PHP developers announced two critical vulnerabilities, and an update fixing them was released on 21 October. [ 2 , 5 ]
- Government sites in the Netherlands and Finland were switched off over the PHP vulnerabilities. [ 2 , 5 , 7 ]
- Wiz was named as the company that found the vulnerabilities. [ 3 , 5 ]
- State sites were switched off in 13 countries, according to TASS. [ 7 ]
- Slovak state sites were switched off on the advice of the National Cybersecurity Authority, according to Dennik N via TASS. [ 4 ]
- Parts of Japanese finance and health ministry sites were temporarily unavailable. [ 8 ]
Still unclear
- Which news agency first reported the vulnerabilities. TASS's headline names Bloomberg, while its summary says Reuters reported it.
- Which governments were first to switch off their sites. Meduza lists the Netherlands, Denmark and Finland, while TASS says the Netherlands, Finland and Belgium were first.
- How the vulnerabilities were found. A TASS item says a GPT AI model helped, RBC names Wiz and an AI system in the Patch the Planet effort, and Kommersant lists Wiz's own tools plus Google Gemini 4 Argon and OpenAI GPT-5.6 Sol.
- How far hackers have exploited the flaws. Kommersant says they were already used by hackers and Meduza cites reports of hackers breaking into sites, but no document gives details.
What local media are saying
Timeline, local time
- TASS reports, citing Bloomberg, that Europe is restricting sites built with PHP. [ 1 ]
- Meduza reports that European governments have begun switching off sites. [ 2 ]
- RBC reports mass shutdowns of sites in the EU. [ 3 ]
- TASS, citing Dennik N, reports Slovak state sites switched off. [ 4 ]
- Kommersant reports shutdowns in France, Germany, Belgium and other countries. [ 5 ]
- TASS reports that state sites in 13 countries were switched off. [ 7 ]
- On 22 October TASS reports that several Japanese government sites were temporarily switched off. [ 8 ]