10-29-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Flaws in PHP, the programming language behind roughly 70% of websites, prompted governments and companies worldwide to take sites offline this week. The shutdowns came after AI tools uncovered critical vulnerabilities in the widely used language, sending organizations scrambling to guard against possible hacks.
Key Takeaways:
- A pair of severe bugs in PHP, the language powering most of the internet, gave attackers a way to seize servers unchecked, and a premature leak turned a planned patch rollout into a worldwide scramble.
- Australia’s own cyber defenders found their public website knocked offline, a reminder that even the agencies tasked with guarding the nation can be caught in the fallout of a flaw they didn’t create.
- South Korea convenes security meeting, treating a software bug as a matter of national security.
Governments and companies around the world shut down websites last Wednesday as they raced to protect themselves from hacks after artificial intelligence (AI) uncovered critical flaws in a widely used programming language called PHP.
Australia’s cyber security agency was among the government websites affected by the vulnerabilities, while South Korea’s Office of National Security (ONS) convened an emergency cyber security meeting involving civilian, government, and military authorities.
Two cracks in the web’s foundation
Websites around the world went offline on October 21 so their operators could patch two critical vulnerabilities in PHP, the programming language behind much of the web. The flaws, collectively called PHP2Shell, were uncovered by teams at OpenAI, Google (NASDAQ: GOOGL)-owned cybersecurity company Wiz, and the security firm Calif.
Both flaws were rated 9.2 out of 10 on the Common Vulnerability Scoring System, the industry’s standard measure of severity, placing them in the “critical” category because they allow attackers to execute code on servers without logging in. Both vulnerabilities also stem from how PHP manages memory while handling visitors’ requests, as in certain situations, it can leave behind scraps of half-finished or discarded data that a skilled attacker can manipulate to slip in their own commands.
PHP reportedly planned to disclose the vulnerabilities alongside the release of fixes on October 22, but word of the flaws leaked on an online tech forum on October 20, prompting PHP to move its release up by a day and publish fixes on October 21.
After the now-deleted leaked post claimed that two maximum-severity PHP vulnerabilities would be disclosed on October 22, hackers began trying to exploit them, prompting security agencies around the world to urge website operators to update immediately. Amazon’s threat intelligence team later said it had detected an attempt to exploit the flaws as early as October 17, four days before they were publicly disclosed.
In response to the threat, on October 21, the European Union Agency for Cybersecurity (ENISA) released a statement warning that the vulnerabilities “could allow attackers to remotely execute malicious code on vulnerable servers without authentication.”
It went on to advise organizations to “identify their PHP-based applications, coordinate with hosting and service providers, and apply the released security updates,” and where this is not possible, “consider isolating exposed applications from public networks until fixes can be applied.”
Meanwhile, the same day, the United States’ National Security Agency (NSA) announced that it was “prioritizing identification of malicious cyber actors that may seek to exploit these vulnerabilities” and advised organizations to maintain heightened awareness of internet-facing devices and services reliant on PHP, as well as to prioritize incorporating vendor patches. Where websites could not be fixed immediately, the agency urged organizations to take them offline.
PHP began in 1994 as the personal project of Danish-Canadian programmer Rasmus Lerdorf, who wrote a few simple tools to track visits to his online CV, and later shared them for free. Over the course of three decades, volunteers turned it into one of the foundations of the web, and today it runs behind roughly 70% of websites, including Wikipedia and the millions of sites built on WordPress.
This is why a flaw in PHP itself, rather than in any single website, caused such widespread and immediate concern across the globe, not least in the EU and the U.S.
In Europe, the response was particularly visible, with several government, school, and hospital websites across the continent taken offline. According to an October 21 Reuters report, in the Netherlands, the Port of Rotterdam and government portal Overheid.nl were among the sites taken offline, while Finland suspended public network services as a precaution, and Belgium’s foreign ministry temporarily took down its websites.
Beyond Europe, among the nations rushing to manage the threat was Australia, whose cybersecurity agency’s own website was among the government sites affected.
Australian government sites exposed
In an October 21 post on X, the Australian Signals Directorate (ASD)—the government agency responsible for foreign signals intelligence, cyber security, and offensive cyber operations—said it was “aware of an outage that may be affecting Government websites, including cyber.gov.au.”
It added that “organizations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.”
In a longer alert on its website, which has since been updated to note the patches released by PHP to address the vulnerabilities, the agency outlined the “critical vulnerabilities” while offering assurance that its cybersecurity department (the Australian Cyber Security Centre) was “not aware of successful active exploitation within Australia, related to these vulnerabilities.”
Despite not suffering any hacks, efforts to mitigate risk and fix vulnerabilities reportedly took a toll on some systems. A spokesperson for the Australian Home Affairs Minister Tony Burke said the nation’s cyber security watchdog was aware of “disruptions to several Australian websites,” including government websites, according to an October 21 report from local outlet ABC News.
“Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability,” the spokesperson added.
But Australia wasn’t the only country scrambling to account for the newly discovered PHP2Shell flaws; South Korea also took swift action.
South Korea convenes security meeting
On October 22, South Korea’s Office of National Security (ONS) convened an emergency cybersecurity meeting, bringing together civilian, government, and military authorities to review the country’s responses to the security flaws, according to a report from local outlet The Korea Herald.
The meeting, chaired by the third deputy director of the ONS, Song Ki-ho, brought together senior officials from the Ministry of Science and ICT, the Ministry of National Defense, and the National Intelligence Service; the top agencies for civilian, government and military cyber security crisis management, respectively—again highlighting the perceived seriousness of the threat.
The meeting was reportedly aimed at coordinating the agencies’ collective response to cyber threats, reviewing PHP usage, and the status of measures taken across the public, private, and defense sectors to address the newly discovered vulnerabilities.
The meeting also discussed how to accelerate security updates, introduce temporary safeguards for websites unable to install patches immediately, and check for signs of potential breaches, with the participating agencies agreeing to share threat intelligence on their responses and strengthen coordination.
“The vulnerability could allow attackers to take control of servers without authentication, and attack attempts have already been reported overseas,” ONS deputy director Song said, as reported by The Korea Herald. “How quickly we respond will determine the scale of the damage.”
He went on to urge civilian, government, and military authorities to work together to implement security measures as quickly as possible.
Such rapid responses around the globe appear to have paid off. As of October 23, no major breaches due to the PHP vulnerabilities have been reported, though security firms, including those of Amazon (NASDAQ: AMZN) and Cloudflare (NASDAQ: NET), have logged widespread exploitation attempts, and the Netherlands’ National Cyber Security Centre said it was investigating early signs of successful attacks.
FAQs:
What is PHP2Shell, and why is it considered so serious?
PHP2Shell is the collective name for two critical vulnerabilities in PHP, each rated 9.2 out of 10 on the Common Vulnerability Scoring System. They let attackers run code on a server without logging in. Both stem from how PHP manages memory while handling visitors’ requests, which can leave behind discarded data that a skilled attacker can manipulate to slip in their own commands.
Why did so many websites go offline on October 21?
Operators took sites down to patch the flaws or to protect themselves until fixes could be applied. PHP runs behind roughly 70% of websites, including Wikipedia and millions of WordPress sites, so a flaw in PHP itself caused wide and immediate concern.
Which governments and organizations were affected, and how did they respond?
In Australia, the cybersecurity agency’s website (cyber.gov.au) was among the government sites affected, though the Australian Cyber Security Center said it was aware of no successful exploitation there. In Europe, sites including the Port of Rotterdam and Overheid.nl in the Netherlands, Finland’s public network services, and Belgium’s foreign ministry websites were taken offline. South Korea’s Office of National Security held an emergency meeting on October 22 with civilian, government, and military authorities to coordinate its response.
Did hackers actually exploit the flaws?
Exploitation attempts were reported, and Amazon’s threat intelligence team said it detected one as early as October 17, four days before public disclosure. As of October 23, however, no major breaches had been reported.
In order for artificial intelligence (AI) to work right within the law and thrive in the face of growing challenges, it needs to integrate an enterprise blockchain system that ensures data input quality and ownership—allowing it to keep data safe while also guaranteeing the immutability of data. Check out CoinGeek’s coverage on this emerging tech to learn more why Enterprise blockchain will be the backbone of AI.
Watch: Can we trust AI? How blockchain and IPv6 could fix accountability
