If you tried to open a government website this week and found it missing, you’ve already felt the effects of one of the biggest web security scares in years. Websites across several continents went quiet at the same moment, and many of us were left wondering what was going on.
Here is the story in plain language, along with what you can do about it.
The day the websites went dark
On Wednesday, 21 October, government websites across Europe went dark as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. The shutdowns spread quickly across many countries.
Germany’s federal IT service provider took several websites offline. France’s Interior Ministry temporarily pulled the websites of local government offices while it waited for a security fix. Belgium’s foreign ministry took its sites down after reports of attacks exploiting the flaws. Danish municipal IT company Kombit shut down several services, including the national school communication platform. The Netherlands took several websites of its public health institution offline.
It wasn’t only Europe. In Canada, Artificial Intelligence Minister Evan Solomon said some government websites had been taken down temporarily as a precaution, and described it as a global issue. Even organizations like Wikipedia and the Internet Archive took some pages offline. Cybersecurity agencies in the U.S., U.K., EU, Canada, Australia and Japan urged organizations to find and patch their PHP systems.
It looked dramatic, but it was a careful, deliberate response, and it was mostly about prevention. We’ll come back to why.
First things first: what is PHP?
You’ve almost certainly used PHP today without knowing it.
PHP is a programming language that runs websites from behind the scenes. When you load a page, the server running PHP assembles the content and sends the finished page to your browser. Think of a restaurant kitchen. You see the dining room, which is the website. PHP is the kitchen crew that prepares everything before it reaches your table.
PHP is free, open source and maintained by volunteers, and site owners rarely interact with it directly. That quiet reliability is one reason it became so popular. PHP runs nearly 70 per cent of all websites whose programming language can be identified, according to W3Techs, and it’s the engine behind WordPress, which powers about 40 per cent of all websites. That means blogs, small business pages, online shops, news sites and government portals.
So when something goes wrong at the core of PHP, the effect isn’t limited to one company or one country.
What exactly went wrong?
Two serious weaknesses, known as vulnerabilities, were found in PHP. They are tracked as CVE-2026-109618 and CVE-2026-109619, and each scored 9.2 out of 10 for severity.
Security scores can feel abstract, so here is what that number means. CERT-EU, the European Union’s cybersecurity response team, said the rating signals “unauthenticated remote code execution”. That means an attacker can run commands on a vulnerable server over the internet with no password or account.
Picture a house where someone could walk in through a hidden door and take over the whole building without ever knocking or showing a key. Anyone who controls the server controls the website. Web host GoDaddy said that could mean stolen data, defaced pages or full-system compromise.
And because the flaw sits in PHP itself, a single flaw opens the same door on millions of servers at once.
The twist: artificial intelligence found them
The way these flaws were discovered may be the most remarkable part of the story.
Researchers at security firm Calif, working with OpenAI, reported the first flaw to PHP on 11 August after finding it with an AI model. Security firm Wiz, owned by Google’s parent company Alphabet, independently found the flaws and reported a second one on 24 August, also using AI models.
The flaws weren’t new. Wiz said they had been present for decades, but proving they could be exploited took a chain of steps “at the edge of what human researchers could practically achieve.” Wiz called the findings among the most severe vulnerabilities ever discovered in PHP.
Many people will find this unsettling, but there is a reassuring side too. The good guys found the problem first and reported it privately, which gave PHP’s maintainers time to prepare fixes. AI is a powerful tool in security, and like most tools, who uses it first matters. The same technology that can help defenders find hidden weaknesses could, in the wrong hands, help attackers find them. That’s why speed matters so much right now.
Why shut websites down at all?
This question confused a lot of people. If a fix exists, why not just apply it?
The answer is timing. PHP’s developers announced the two critical vulnerabilities on Tuesday and encouraged site managers to take their websites down or update them as soon as a fix was available. The fix came on Wednesday, but applying it across thousands of systems takes time. Large organizations have to test changes carefully so the fix doesn’t break something else.
Meanwhile, attackers move quickly. Cloudflare’s chief technology officer said the company had detected early attacks and was updating its firewall protections as an interim measure. So the safest option for many was to switch the site off, like locking the doors while the locksmith is on the way.
The FBI’s advice was that if an immediate update isn’t feasible, organizations should take the system offline until it can be fully mitigated.
Many of the shutdowns were purely precautionary. Finland’s state IT provider, which shut down the government’s public web services, called it a precautionary measure. It said it had not identified any attempt to exploit the flaws and that the outage was not the result of a data breach. In other words, much of the world acted before anything went wrong.
Is there a fix?
Yes, and that’s the good news. PHP released fixes for supported versions 8.2 through 8.5 and urged users to update immediately. Governments say the sites will return as patches are applied. Canada’s minister said affected federal websites will be restored once patches are applied, and some sites are already back up and running.
There’s a catch, though. Cybersecurity authorities warned that websites remaining on vulnerable versions could still face attacks even after the fixes were released. A patch only helps once it has been installed.
Older systems may need extra attention. Officials said all PHP versions from PHP 5 onwards could be affected. If your site runs on an old version that no longer gets updates, talk to your developer or host about upgrading.
Why small websites should pay attention
Governments have IT teams. Many small businesses, bloggers and community groups don’t. Most small websites are run by owners with no security staff, often on shared hosting where they don’t manage the server and may not know who updates PHP.
There’s also a common trap. If you use WordPress, you might assume its automatic updates will protect you. Wordfence warned that the usual automatic updates will not apply this fix. The PHP software lives on the server underneath your site, so keeping WordPress itself up to date isn’t enough. That update has to come from your hosting provider or whoever manages your server.
What you can do
If you simply browse the internet, you can relax. A site going offline may be taking precautions, and the available information does not indicate that simply visiting an affected site infects your device. If a site you use is down, be patient, and be careful about emails or messages claiming to be from it. Scammers love moments of confusion, so don’t click unexpected links asking you to “verify” or “restore” your account.
If you own or manage a website, work through this list:
- Find out whether your site uses PHP. WordPress, Drupal, Joomla and Magento all do.
- Contact your hosting provider today. Ask plainly: “Has PHP been updated on my server to fix the October 2026 vulnerabilities?”
- Update to a patched version. Fixes cover PHP 8.2 through 8.5, so if you’re on something older, ask about upgrading.
- If you can’t update immediately, consider taking the site offline for now, as the FBI and other agencies advise.
- Back up your site, and watch for anything unusual, such as unfamiliar admin accounts, odd files or sudden slowness.
- Keep your own accounts safe. Use strong, unique passwords and two-factor authentication on your hosting, email and admin logins.
If any of this sounds technical, that’s okay. Asking your host for help is a perfectly good first step, and this week they’ve likely heard the question many times.
The bigger lesson
This episode is a reminder of something easy to forget: the internet is held together by shared tools, many of them free and maintained by volunteers. When one of those tools has a problem, millions of people feel it at once.
It also showed the world responding well. Researchers reported the problem privately. Developers built fixes. Agencies in many countries gave consistent advice. Organizations chose caution over convenience, even when it meant their own websites went dark.
None of that makes the risk disappear, but it’s a good model for how to handle one. Stay informed, update promptly, and ask for help when you need it. If you run a website, take a few minutes this week to check that yours is protected.
We’ll keep watching this story and share updates in future editions. Meanwhile, look after yourself, and look after your websites too.
