A vulnerability in PHP — the programming language underpinning roughly 70% of the world's websites — became public on Tuesday and triggered a cascade of government-ordered shutdowns across Europe. Dutch, German, Belgian, Finnish and French sites went dark, including the Netherlands' national digital identity service, its house of representatives, and its national cybersecurity centre's own website. In the UK, council sites in Edinburgh, Bristol and Oxford were pulled offline. The Paris police prefecture followed suit. The flaw is not a new exotic attack vector. The underlying vulnerabilities are decades old, discovered by researchers testing cyberdefences and disclosed through a coordinated process. The PHP project issued a patch on Wednesday. The US National Security Agency and the UK's National Cyber Security Centre both told organisations to take unpatched systems offline immediately, warning the bug could provide "a direct path to the server's file system or database." The NCSC also told organisations to check for backdoors already installed by attackers. The blast radius is enormous because PHP is everywhere. WordPress, Wikipedia, Slack, and historically much of Facebook all run on it. The Wikimedia Foundation took several systems down as a precaution. Prof Alan Woodward of Surrey University called the discovery "very surprising and troubling" given PHP's global footprint, but flagged the real problem: the long tail of poorly maintained sites that will remain vulnerable for weeks or months, providing a persistent attack surface. That long tail is the story. Internet infrastructure expert Michał Woźniak described the situation as "an environmental problem in an industry where there's an incentive to move fast and make changes" and "an incentive to deploy a thing and then never update it and not think about maintenance." The vulnerability will be exploited automatically. Cryptocurrency miners will hijack vulnerable servers. Organised crime groups and Russian state actors could use compromised sites as launching pads for DDoS and other cyber-attacks. OpenAI claimed its researcher coalition discovered the flaw and said "frontier AI" was key to the discovery. The actual researcher who found the weakness, however, stated they did not use models unavailable to the general public — a notable divergence from OpenAI's framing. The discovery mechanism matters less than what it exposed: a global infrastructure built on a language with decades-old unpatched weaknesses, maintained by an ecosystem with no systematic incentive to keep things updated. The patch exists. The race is on. But the structural problem — millions of websites running unmaintained PHP installations with no one responsible for updating them — is not a bug that gets fixed on Wednesday. It is the baseline condition of the internet, briefly made visible.
