Two critical breaches discovered in PHP programming language, used by around 75% of the websites whose language can be identified, have triggered a global cybersecurity crisis. The Netherlands, France, Finland, Denmark and Germany have preemptively shut down government portals, and Cloudflare warns that the attacks have already started. In Romania, the authorities are on alert, but no massive closures have been reported.

(Staff: Europe / Technology & Cybersecurity)

---

On Wednesday, October 21, 2026, the Internet again had a dark day. Just a few days after a downpour of Google Cloud left millions of Revolut users without access to money, a new crisis has hit global digital infrastructure. This time, the problem did not come from a cloud provider, but from one of the oldest and most widespread programming languages in the world: PHP.

On Tuesday, PHP developers announced the identification of two critical vulnerabilities and urged users to update their sites immediately. On Wednesday, around 1:45pm GMT, a fix version was released. But by then, cybersecurity agencies around the world had already gone on high alert. And in some countries, the measure was radical: the sites were completely offline.

What is PHP and why does it matter

PHP is an open-source programming language used for developing web-side server applications. When a visitor accesses a page, the server runs PHP, assembles the content and sends it to the browser. It is free, maintained by volunteers and is the basis of approximately 75% of websites whose programming language can be identified, according to w3techs. It is the engine behind WordPress, a platform used by about 43% of all websites, from personal blogs to government portals and online stores.

This massive spread explains why a vulnerability in PHP is not a minor technical problem but a systemic threat. Cybersecurity company Huntress summed up the situation in a blog post: “PHP is everywhere. It discreetly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and a lot of programs that don’t At least they don’t mention they use PHP behind the scenes.”

The chain reaction of European governments

Faced with such a wide threat, European governments did not wait. On Wednesday, several states decided to take their sites out of operation preventively, preferring downtime to the risk of a security breach.

In Netherlands, the National Cyber Security Center interrupted its own online activity, and several organizations followed its example: Rotterdam Port, Overheid.nl government portal, KNVB National Football Federation, the sites of the five largest parties political and several hospitals have been taken offline.

In France, the Ministry of the Interior announced that it has temporarily taken the administrative sites of the local authorities out of service, “waiting for a security solution”. According to the publication Le Figaro, the website of the Fiscal Administration, that of the Police Prefecture and the prefectures in the departments were affected.

In Finland, the state’s IT service provider, Valtori, announced that public services in the government network have been taken out of service “as a precautionary measure”. In Denmark, the municipal IT company Kombit has closed several services, including the National School Communication Platform. and in Germany and Austria, some universities and local authorities have taken similar measures.

Global warnings and already ongoing attacks

Cybersecurity agencies in the European Union, Australia, Japan and the UK have urged PHP users to install updates immediately or take their sites out of service until the corrections are applied. Dane Knecht, Cloudflare’s technical director, said the attacks have already started: “We see attacks are starting to occur and we are updating risk mitigation measures as new attack vectors appear. This is only a temporary measure. Install the update as soon as PHP launches it.”

Experts warn that the extent could be enormous. Lukasz Olejnik, a researcher at King’s College London, said the threat could be amplified by artificial intelligence-assisted hacking campaigns that have multiplied in recent weeks. “The extent is enormous. And with the help of artificial intelligence, the exploitation of vulnerabilities could happen instantly and on a large scale,” he warned. The risk is particularly high for small sites managed by individuals or organizations with limited technical resources that do not directly manage their servers.

The situation in Romania

According to the available information, no massive closures of government sites have been reported in Romania, similar to what happened in the Netherlands or France. However, authorities are on alert and system administrators have been urged to urgently apply the patch released by PHP developers. Given that Romania hosts numerous institutional sites built on WordPress and other platforms running PHP, the risk remains significant.

Conclusion

A vulnerability in a free programming language, maintained by volunteers, has managed to take offline government sites from the western half of Europe and trigger a global mobilization of cybersecurity agencies. It was not a coordinated attack, but a technical breach in a software used by three-quarters of the global Internet. And the reaction of governments — to preempt the sites — shows how fragile the digital infrastructure we rely on every day is.

The patch was released on Wednesday afternoon. But for many sites, the update will not be instantaneous. And the attackers know this. It remains to be seen if the breach will be exploited on a large scale and how many institutions will pay the price of a delay of several hours.