Websites belonging to governments, schools and hospitals across Europe went offline on Wednesday after two critical flaws were found in PHP, one of the most widely used programming languages on the web.
Ajay Bagga, in a post on X, described PHP as “a technology that powers as much as 70% of the world’s websites.” He wrote that PHP’s creators disclosed the issue on Wednesday, and that attackers could use it to take over any system running PHP, steal data or target a hacked site’s visitors.
PHP’s developers have since released updates to fix both vulnerabilities and are urging users to install them without delay, according to Reuters.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
ALSO READ | ‘Utterly Unacceptable’: Outrage In Australia As Rogue OpenAI Agents Hack Govt Site
Found Using AI
“Security researchers found the vulnerability using AI,” Bagga wrote. He noted that administrators are racing to secure their systems, since advanced AI could also help hackers exploit it.
Named PHP2Shell, the issue stems from the way PHP manages memory. According to Bagga’s post, attackers could abuse it in several ways, some within seconds, to run unauthorised software on any server that hasn’t been patched.
The post also cites Volker Dusch, a security engineer at the nonprofit foundation behind PHP, who called it the language’s most severe security problem in over ten years and likened it to Heartbleed, a widespread bug from more than a decade ago.
ALSO READ | Google Gemini Hacked Three Companies During An AI Security Test. Here’s What Happened
AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it. The creators of PHP, a technology that powers as much as 70% of the world’s websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software. That would allow an attacker to steal information or launch a cyberattack on anyone visiting a hacked website. Security researchers found the vulnerability using AI. Now web administrators are scrambling to protect themselves from the vulnerability, which cutting-edge AI systems could quickly exploit. Some say they are preemptively taking their sites offline. The issue, dubbed PHP2Shell, represents a class of problems in the way PHP manages a computer’s memory. It can be exploited in many ways, some requiring just a few seconds, by hackers who could use it to run unauthorized software on any unpatched web server. It is the most severe security issue that PHP has faced in more than a decade, according to Volker Dusch, a security engineer with the nonprofit foundation that manages the PHP project. He likened it to Heartbleed, a similarly widespread vulnerability that forced a global race to protect hundreds of thousands of servers more than a decade ago.
— Ajay Bagga (@Ajay_Bagga) October 21, 2026
Websites Go Dark Across Europe
The EU’s cybersecurity response team, CERT-EU, had told organisations to think about pulling affected sites if they couldn’t install the fixes in time, Reuters reported.
In the Netherlands, the Port of Rotterdam, the government portal Overheid.nl, football body KNVB, the country’s five biggest political parties and many hospitals took their sites down, following guidance from the National Cyber Security Centre. Germany’s federal IT provider ITZBund disabled several websites as a preventive step, with the digital ministry saying it knew of no security incidents.
France shut prefecture websites until a patch arrived, while Finland’s state IT centre Valtori switched off government web services, adding that it had spotted no exploitation attempts.
Belgium’s foreign ministry pulled its websites after reports of attacks, even though the national cybersecurity centre said no Belgian sites had been hit. Wikimedia, which runs Wikipedia, also took several systems down as a precaution.
Attack Warnings
Cloudflare reported seeing early attacks, but Australia’s cyber agency said it knew of no active exploitation. The US National Security Agency cautioned that such flaws can offer “a direct path to the server’s file system or database,” and told organisations that can’t update straight away to take vulnerable systems offline. PHP’s developers said a set of new updates fixing two previously identified critical vulnerabilities was now live and strongly encouraged users to utilize them immediately, as per Reuters.
.
Essential Business Intelligence,
Sharp Market Insights,
Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
