22.10.2026 06:30
A cybersecurity alarm has been raised after two critical security vulnerabilities were detected in the PHP software widely used in the infrastructure of websites worldwide. Due to the vulnerabilities that allow attackers to take over servers without a password under certain conditions, the websites of many public institutions in France, the Netherlands, Germany, Finland and Belgium were temporarily shut down.
Two critical security vulnerabilities have been detected in the PHP programming language, which is used in the infrastructure of millions of websites worldwide. Due to the vulnerabilities, which may allow attackers under certain conditions to access servers without needing a password, the websites of many public institutions in Europe were temporarily shut down. Security experts called on website administrators to urgently update their systems.
GOVERNMENT SITES SHUT DOWN IN EUROPE
Following the security vulnerabilities uncovered in the PHP software infrastructure, cybersecurity agencies in the US, European Union, UK, Japan and Australia took action.
In countries including France, the Netherlands, Germany, Finland and Belgium, many public institutions temporarily closed their websites to access in order to prevent possible attacks.
In France, the websites of some public institutions, including the Paris Police Department, were shut down, while in the Netherlands the national digital identity system DigiD, the House of Representatives and the National Cyber Security Centre websites were taken offline.
The Port of Rotterdam in the Netherlands, some hospitals and the websites of political parties were also affected by the measures.
The Finnish government temporarily suspended some public internet services, while in Germany some federal government websites were shut down. The Belgian Ministry of Foreign Affairs took a similar measure.
Authorities in Finland and Germany reported that these decisions were taken to prevent possible risks, not because of a verified cyberattack.
USED ON APPROXIMATELY 70 PERCENT OF WEBSITES
The main reason the vulnerabilities have caused worldwide concern is the widespread use of the PHP programming language in internet infrastructure.
According to data from W3Techs, which tracks internet technologies, PHP is used on approximately 70 percent of websites whose server-side programming language can be determined.
PHP, which is used in the infrastructure of common content management systems such as WordPress, Drupal, Joomla and Magento, operates across a wide area ranging from news sites to shopping platforms, from public services to corporate web pages.
However, this does not mean that all websites using PHP are affected by the vulnerability or have been attacked. The scale of the risk varies depending on the software version used and the configuration of the servers.
SERVERS CAN BE SEIZED WITHOUT A PASSWORD
The severity of the detected security vulnerabilities was assessed as 9.2 out of 10 on the international CVSS scale.
According to the European Union Agency for Cybersecurity Incident Response Team (CERT-EU), the vulnerabilities may, under certain conditions, allow attackers to execute code remotely on vulnerable servers without the need for a user account or password.
This creates serious risks such as theft of sensitive data on websites, installation of malware, defacement of pages and taking control of systems.
The US National Security Agency (NSA) also warned that attackers could exploit the vulnerabilities to access servers' file systems and databases.
FIRST ATTACK ATTEMPTS HAVE BEGUN TO BE SEEN
Dane Knecht, technology director of internet infrastructure company Cloudflare, announced that the first attack attempts to exploit the vulnerabilities have begun to be detected.
However, the US Cybersecurity and Infrastructure Security Agency (CISA), in its published warning, reported that it had no verified observation that the vulnerabilities in question had been exploited.
Experts warned that attack attempts could become widespread and stressed that system administrators should apply security updates without delay.
ARTIFICIAL INTELLIGENCE UNCOVERED THE CRITICAL SECURITY VULNERABILITIES
It was stated that artificial intelligence technologies played an important role in detecting the security vulnerabilities threatening internet infrastructure.
Cybersecurity company Calif, using OpenAI's GPT-5.6 Sol model, reported the first critical vulnerability it identified to PHP developers on August 11.
OpenAI also independently reported the root cause of the same issue on the same day.
Google's cybersecurity company Wiz, on August 24, uncovered different attack methods and the second security vulnerability through AI-supported analyses.
Wiz assessed the detected issues as among the most serious security vulnerabilities identified to date in the PHP infrastructure.
Researchers noted that the vulnerabilities are based on bugs that have existed in the software for many years, but that uncovering how these bugs could be used in attacks required advanced analysis.
DEVELOPERS ADMIT DELAY
The PHP Foundation, which supports the development of PHP, announced that the first signs of one of the security vulnerabilities were noticed in 2024.
However, it was stated that at that time it could not be shown that the bug could be turned into a concrete attack method.
The organization acknowledged that the delay in fixing the issue was a structural failure caused by decision-making processes and insufficient resources.
After some information about the security vulnerabilities leaked onto the internet on October 20, the release date of updates initially planned for October 22 was moved forward by one day.
FOUR EMERGENCY UPDATES RELEASED
PHP developers released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix two critical security vulnerabilities.
The PHP Foundation asked organizations using the software to install the security updates immediately.
The UK National Cyber Security Centre also advised organizations that cannot immediately apply the updates to temporarily take their affected systems offline until the necessary security measures are completed.
Experts stressed that websites using especially older PHP versions should be updated, unnecessary external access should be restricted, and systems should be examined to determine whether they have previously been exposed to a possible attack.