Critical PHP Flaws Took Sites Offline Worldwide

According to the BBC, governments and agencies around the world urged websites to address two critical flaws in PHP, a programming language used on servers to build much of what you see when you visit a website. A fix was issued on Wednesday afternoon.

The UK's National Cyber Security Center, along with its EU and Australian counterparts, told organizations to apply it. Where that isn't feasible, the NCSC said, "organizations should consider taking the system offline until it can be fully mitigated." The US National Security Agency gave similar advice on X, warning that these vulnerabilities "often provide a direct path to the server's file system or database."

Some organizations took that advice literally. Finland temporarily shut down the government's public web services. The Netherlands' cybersecurity agency took its own site offline, and so did the country's National Institute for Public Health and the Environment.

The website of the Tweede Kamer, the lower house of the Dutch parliament, became inaccessible. The Wikimedia Foundation said it had "taken down a number of other systems as a precautionary measure until they can be safely patched," which left some people unable to reach parts of Wikipedia. DeviantArt said it was "temporarily down for maintenance" without giving a reason.

Edinburgh council's website and the online homes of several BBC programs also went dark, but neither has confirmed a link to PHP.

Why One Flaw Reaches So Far

The scale comes from where PHP sits. Cybersecurity company Huntress says it "quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."

Sophos's Don Smith told the BBC the hard part isn't installing the patch. It's finding every place PHP is running, because it "can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organization using it."

The flaws were found by AI. Wiz said, "frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours." That cuts both ways. If researchers can build working exploits in hours, so can attackers, and the time between a fix being published and attacks starting gets shorter. Cloudflare's CTO, Dane Knecht, said he was already "seeing early attacks emerging."

When Security and Availability Collide

Taking a vulnerable site offline is a reasonable call. If you can't patch in time, a site that's down is safer than one that's compromised, and nobody should criticize the Finnish government or the Wikimedia Foundation for being cautious.

It's still worth looking at what the advice amounts to. When protecting a server and keeping it reachable pull in different directions, the protocol is to protect the server. The people who depended on those pages aren't part of that calculation. A Dutch public health institute's website, a government's public services, parts of the world's biggest encyclopedia: all went dark on the same afternoon, for reasons no user could have predicted or prevented.

Nobody cut the internet to silence anyone this time, unlike the shutdowns we've covered all year. For someone trying to reach a page they needed, the result looked the same. We wrote recently about how records quietly disappear and how a right to information assumes the information still exists. This is a faster version of the same problem.

Nobody Is Holding Your Copy

Agencies did their job here. They issued warnings quickly, and the people working on the fix are moving fast. But none of that was addressed to you. It was addressed to site operators, and the option it offered them, switching off, is one that only affects users. No agency is going to keep a copy of the page you depend on. You have to do that yourself.

A few practical steps:

• Save what you can't afford to lose: Download the forms, confirmations, official notices, and health or legal information you rely on, and keep them somewhere you control.
• Know your second source: For anything important, find an alternative before you need it, whether that's a phone number, an archived copy, or another official channel.
• Treat "down for maintenance" as a signal: Sites taken offline for security reasons are often followed by notices about account data. Use unique passwords and two-factor authentication so one compromised site doesn't become many.
• If you run a site, inventory your PHP: Update, and don't assume a hosting provider or plugin has done it for you.

A VPN won't patch anyone's server and can't bring a site back. What it does is encrypt your connection and hide your IP address from the sites and networks you connect through, which limits what a compromised or watching party can learn about you. It's one layer, and it only covers your side. That's the part we can help with, and we'll keep covering these events and publishing practical guidance as they happen.