Government websites across Europe and other regions went offline on 21 October after developers identified two critical vulnerabilities in the PHP programming language. A new version of PHP containing fixes for these security flaws became live at 13:45 GMT on 21 October.
The Dutch cybersecurity agency and several hospital websites in the Netherlands were taken offline as a precaution. Other Dutch entities, including the national soccer association KNVB, the government portal Overheid.nl, and the websites of the country's five largest political parties, also shut down their sites.
The Port of Rotterdam took its public-facing website offline while the Danish municipal IT company Kombit suspended several services, including the national school communication platform. In Finland, Valtori took public network services offline as a precautionary measure, while France's Interior Ministry temporarily moved local government administrative websites into preventive maintenance.
The flaw was discovered using artificial intelligence and remained hidden in the PHP codebase for more than 10 years. Wiz used Wiz Atlas, Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol to research the vulnerability and coordinated with the PHP team, OpenAI, and Calif on the discovery and patch verification.
The White House was informed of the flaw on 19 October and stated, "This discovery demonstrates exactly why American leadership in SI is so critical." Wiz partnered with Google Cloud, Cloudflare, Amazon’s AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, and Vercel to address the issue.
Japanese Prime Minister Sanae Takaichi urged users to "check whether your live site uses PHP and prepare to apply the new fix." Lukasz Olejnik noted that the scale is huge and exploitation may happen instantly on a large scale with AI, while Costin Raiu stated that AI was powering a “race to exploit.”
PHP runs roughly 75% of websites whose programming language can be identified, and WordPress powers about 43% of all websites. Other actions included the operator of Wikipedia taking down an unspecified number of systems and Sakura Internet suspending a database appliance function on 21 October.
