Critical PHP flaws prompt shutdowns of government websites across Europe

Government websites throughout Europe became unavailable on Wednesday as operators raced to patch two critical vulnerabilities in PHP, a scripting language widely used in website development.

The security issue involves two flaws that could allow attackers to trigger an out-of-memory condition, resulting in memory corruption and potentially enabling code execution under certain conditions.

PHP is a widely used, open-source general-purpose scripting language. It runs on servers to generate web content, interact with databases and perform other functions. It is also integrated into a wide range of software products.

Researchers at cybersecurity firms discovered the flaws with the help of artificial intelligence (AI) tools, according to the BBC. The vulnerabilities had reportedly gone undetected for more than a decade.

The incident affected a range of public services. Finland suspended public online government services, while the Dutch cybersecurity agency temporarily shut down its website because of the vulnerabilities.

Britain's Oxford City Council said on Wednesday that its website was temporarily unavailable as a precaution "because of a worldwide issue affecting the underlying technology."

Britain's National Cyber Security Centre issued an alert on Wednesday, urging organizations to take immediate action to install the available security updates.

The BBC reported that patches were released on Wednesday afternoon.

Dane Knecht, chief technology officer at cloud cybersecurity services company Cloudflare, said on the social platform X that this would not be the last time such vulnerabilities were discovered. AI models, he said, would continue to identify similar flaws in widely used software.

"Maintainers, researchers, providers and governments need a new shared playbook so the response scales with the findings and critical internet infrastructure gets patched," he said.