Government websites across several countries were taken offline on October 21 as administrators rushed to protect them from two critical flaws in PHP, a programming language used behind the scenes by a large share of the web.
Emergency updates are now available. The task on October 22 is getting those fixes installed, checking exposed systems and restoring services safely.
The disruption is serious, but a website going dark does not, by itself, mean hackers stole its data. Some operators deliberately disconnected services to reduce the risk of an attack.
Why one software problem travelled so far
PHP runs on web servers, helping websites generate pages, handle requests and work with databases. Visitors usually never see it. They see the service it supports—until that service becomes unavailable.
The UK’s National Cyber Security Centre says the flaws can, under certain conditions, let an attacker execute code remotely without first signing in. Its guidance calls for identifying PHP installations, applying fixes and considering an offline period when updates or temporary protections cannot be applied promptly.
That explains why unrelated organisations can face the same emergency. Different websites can depend on the same underlying software.
Outages, then a gradual return
Reuters reported precautionary shutdowns involving the Dutch cybersecurity agency, some Wikimedia systems and the Internet Archive, which briefly went offline.
By Thursday, many government sites were working again, although outages and limited services remained, according to The Associated Press. Finland said its disruption had been resolved while some content was still being restored. British officials said some limited services could temporarily be unavailable during security work.
Canada also took some federal websites offline. Digital Innovation Minister Evan Solomon described that response as temporary and precautionary, with restoration following patching, CityNews reported.
The fixes are out. The work is not over.
The PHP Foundation confirmed that releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address the two flaws. It also acknowledged that early signs of one problem were found in 2024, but difficulties agreeing on a fix and limited resources delayed the response.
The foundation describes a combined effort involving human researchers, AI tools and maintainers. Finding a weakness is only part of the job; engineers still have to decide how to repair it without breaking the systems that depend on the software.
The Canadian Centre for Cyber Security’s alert urges organisations to update affected installations immediately, prioritise internet-facing systems and examine logs for signs of compromise. Older PHP versions may require vendor-provided fixes or an upgrade to a supported release.
For users, the useful distinction is between a service taken down for protection and a confirmed breach. Follow the affected organisation’s own notices for restoration and any account-specific advice.
The episode adds a practical dimension to our coverage of AI safeguards and cybersecurity risks: powerful tools can help uncover weaknesses, while the response still depends on people maintaining the infrastructure everyone uses.
