European Governments Take Public Services Offline After AI Finds Critical PHP Flaws
Authorities across Europe have temporarily suspended government websites, hospital portals and other online services after researchers using artificial intelligence uncovered two severe vulnerabilities in the widely used PHP programming language. Security experts warn that attackers are already attempting to exploit the flaws.
Governments across Europe have taken public websites and online services offline as a precaution after researchers using artificial intelligence uncovered two critical security flaws in PHP, a programming language that underpins a large share of the world's websites and web applications. The vulnerabilities, rated 9.2 out of 10 for severity, could allow attackers to run malicious code remotely on vulnerable servers without authentication.
In the Netherlands, authorities suspended access to several platforms, including Overheid.nl, the main government services portal, and MijnOverheid.nl, which citizens use to communicate with the administration. The Port of Rotterdam, the national football federation, several political parties and a number of hospitals were among the organisations affected. France's Interior Ministry announced the temporary closure of prefecture websites while security updates were applied. Finland suspended government online services, Germany disabled several federal sites, and Belgium's Foreign Ministry interrupted its web services. Authorities in the Czech Republic took similar steps.
The disruption extended beyond government. The Wikimedia Foundation, which runs Wikipedia, said it had taken some systems offline as a precaution until fixes were installed, and the Internet Archive was also temporarily unavailable. Officials stressed that taking a site offline does not automatically mean it has been compromised by hackers.
The flaws were identified independently by researchers at the security firms Calif and Wiz, who used AI-based tools, including models developed by Google and OpenAI. According to Wiz, the vulnerabilities had existed in PHP code for more than a decade, but exploiting them through traditional methods would have been extremely difficult. The two issues could permit remote execution of malicious code without authentication on affected servers.
Cloudflare reported that attack attempts had already begun, and Amazon said it had detected an attempted exploitation as early as 17 October, before the flaws were publicly disclosed. PHP developers released security fixes on Wednesday and urged immediate installation. CERT-EU, the cyber incident response team for European Union institutions, recommended temporarily suspending vulnerable systems when updates cannot be applied quickly.
According to the security firm Censys, roughly 1.5 million of the 2.6 million servers identified as running PHP were reporting versions for which no fix was available. Specialists warn that the publication of technical details, combined with the use of artificial intelligence, could accelerate the development of attacks against servers that remain unpatched.
The episode highlights a broader vulnerability in the digital infrastructure that governments, hospitals and cultural institutions increasingly rely on. Much of that infrastructure runs on open-source software maintained by small teams, and a single flaw in a widely used component can ripple across borders and sectors within hours. The decision by authorities in several countries to shut services pre-emptively reflects a growing willingness to accept short-term disruption in exchange for limiting exposure while patches are deployed.
For citizens, the closures meant temporary loss of access to administrative portals, appointment systems and information pages, underlining how deeply public services now depend on web-based platforms. Security experts say the coming days will be critical, as organisations that have not yet applied the updates remain exposed to automated scanning and exploitation attempts that AI tools can now carry out faster than ever before.
17
