Government websites in Europe were taken offline Wednesday, October 21, as officials responded to two critical security flaws in PHP, software used to run many of the world’s websites. Emergency fixes are now available, and administrators face an urgent job: update the underlying server software before attackers can exploit it. These PHP security flaws underline the importance of immediate action.

The Dutch government confirmed precautionary shutdowns affecting services including Overheid.nl, MijnOverheid.nl and DigiD. Finland’s government IT provider also took public web services offline, according to reporting by Yle and Reuters. Those shutdowns were protective measures; their announcement does not establish that the affected services had been breached.

Addressing these PHP security flaws is crucial for the protection of sensitive data and the integrity of government services.

Why the PHP security flaws matter

PHP runs on web servers and helps websites process information and deliver pages. Platforms such as WordPress, Drupal and Joomla depend on it. A vulnerability in that shared software can reach far beyond a single website or plugin.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on a vulnerable server without logging in. Both received a critical severity score of 9.2 out of 10. The PHP project’s security advisory identifies installations serving web requests as at risk and urges immediate updates.

The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations using packages supplied by a Linux distributor or long-term-support vendor should obtain the corresponding security update from that provider. PHP’s developers say temporary workarounds address only particular attack paths; an update is the complete fix.

AI helped reveal the danger, but the history goes back further

Security company Wiz calls the vulnerability group “PHP2Shell” and says AI played a major role in its research. Its team used Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol to investigate the flaws and demonstrate attacks across different applications. Wiz says that work made exploitation practical in cases that would previously have demanded exceptional time and expertise.

There is an important qualification to the description “AI-discovered.” The PHP Foundation says a developer first identified signs of one underlying problem in 2024, following an external security audit. At that point, no concrete route to remote code execution had been found. Reports from Calif, OpenAI and Wiz in 2026 established the full danger and made a fix the security team’s top priority.

The foundation acknowledged that competing technical approaches, its decision-making process and limited staffing had delayed progress. The AI connection therefore concerns both vulnerability research and the ability to demonstrate exploitation. It does not establish that an AI system caused every reported outage.

What governments and security companies have confirmed

In the Netherlands, the government’s October 21 notice described its shutdowns as preventive. It also said many government websites, including Rijksoverheid.nl, do not use PHP and were unaffected by these vulnerabilities. The National Cyber Security Centre said it temporarily took its own main website offline and provided updates through a separate community page.

In Finland, Yle reported that government IT provider Valtori began taking services offline early Wednesday afternoon. The National Land Survey’s website was among those experiencing an outage. A later Reuters report said Valtori had identified no attempted exploitation and described the interruption as unrelated to a data breach. Reuters also reported preventive shutdowns involving government sites in Germany and France.

Separately, Cloudflare said it had observed attack traffic targeting its customers and attackers changing their requests in attempts to evade protections. That is evidence of attempted exploitation. The company’s account does not establish that the government services named above were successfully compromised.

The statements also reflect different observation times and networks. Dutch officials’ earlier notice said they had seen no signs of active abuse; Cloudflare’s account described activity in its own customer traffic. Neither supports a blanket claim that all affected websites were hacked.

What website owners should do now

For Mohawk Valley businesses, nonprofits and other organizations that operate websites, the immediate question is whether their hosting environment uses an affected PHP version and who is responsible for updating it.

• Contact the hosting provider or website administrator. Ask for confirmation that both CVEs are covered by an installed security update.
• Check the server software. Cloudflare warns that updating a website’s code or plugins alone does not repair these PHP vulnerabilities.
• Escalate unpatched systems. CERT-EU advises immediate patching and says organizations unable to do so should consider isolating internet-facing applications until the fix has been applied and verified.

For people trying to use a temporarily unavailable public service, follow the agency’s official notices for restoration information or alternative contact methods. The sources reviewed for this report do not provide a single timetable for all services to return.

This report reflects official advisories and reporting available October 21, 2026. Outage status and security guidance may change as organizations apply updates. The headline supplied for this story appeared in a Reuters report carried by Dawn; this article adds independently reviewed agency and vendor statements.