Websites and government services worldwide were taken offline on Wednesday, October 21, and Thursday, October 22, 2026, following the discovery of critical security vulnerabilities in PHP, a programming language used to power an estimated 70% to 75% of the internet. The PHP Foundation, which maintains the language, released urgent patches after researchers warned that the flaws could allow unauthenticated attackers to remotely execute code on vulnerable servers. Governments in the United Kingdom, France, Denmark, Finland, and the Netherlands suspended various digital services as a precautionary measure while applying security updates.
The vulnerabilities, dubbed "php2shell," involve how the language handles memory errors. Cybersecurity firms Wiz and Calif reported that they identified the flaws using artificial intelligence tools, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The PHP Foundation acknowledged that signs of the vulnerability had emerged in 2024 but stated that a lack of resources and a complex decision-making process delayed the implementation of a fix. Experts noted that while the flaws were historically difficult for humans to exploit due to precise timing requirements, AI tools have made it easier for attackers to identify and target these weaknesses.
In the United Kingdom, tech minister Baroness Lloyd of Effra informed the House of Lords that 32 government services were unavailable and four were partially unavailable on Thursday. The National Cyber Security Centre (NCSC) stated there were no indications of successful breaches despite the outages. Amazon and Cloudflare reported seeing a significant surge in attempts to exploit the flaws; Cloudflare CEO Matthew Prince noted that exploit attempts reached "millions" within hours of the public announcement. While major platforms like Wikipedia and the Internet Archive reported brief temporary outages, large public-facing critical services in the UK were reportedly unaffected.
The scale of the issue is significant because PHP has been a standard web development tool for decades, meaning the flaws exist in nearly every version of the language released over the last 10 to 20 years. While large technology companies and central governments have the resources to patch systems within hours, cybersecurity experts warn of a "long tail" of risk for smaller entities. Small business owners or individual bloggers using shared hosting services may not notice the vulnerability until a breach occurs, as they often do not manage the underlying server software themselves. The NCSC and other international cyber agencies have warned that hackers are actively attempting to exploit these systems before they can be secured.
The use of AI to discover these flaws sets a precedent for how future software vulnerabilities may be identified and exploited. Industry experts like Matt Hull of the NCC Group noted that the "window to respond" to such threats has shrunk from weeks to just hours or days due to AI-assisted hacking. Moving forward, website administrators are urged to apply the PHP Foundation's security releases immediately. While many government sites in Finland and the Netherlands have already returned to service, work continues globally to identify exposures in legacy systems. No specific deadline has been set for all systems to be patched, but the NCSC continues to monitor for signs of successful exploitation.