On 21 October, public bodies across Europe switched off government, hospital and university websites. They did so as a precaution, while developers released fixes for two critical flaws in PHP, as Ana-Maria Stanciuc reported for The Next Web. PHP is the programming language behind a large share of the web. Both flaws are rated 9.2 out of 10 and, under certain conditions, allow an attacker to run code on a server without logging in.
The same day, the PHP Foundation said warning signs of one bug had appeared in 2024, but decisions about a repair had stalled. Its account was reported by Ana Maria Constantin in The Next Web. At that earlier stage, the Foundation says, no concrete route to exploitation had been demonstrated. That turns a one-day scramble into a wider question: who maintains, and pays for, the free software that European public services depend on?
A precautionary blackout, country by country
CERT-EU advised organisations that could not install updates quickly to switch off internet-facing applications until they could, Ellen Vos reported for NU.nl. In Germany, the federal IT provider ITZBund took several sites offline, which a digital ministry spokesperson told Reuters was purely preventive, according to The Next Web. France’s Interior Ministry pulled prefecture websites, Finland’s state IT centre Valtori shut public web services and Denmark’s municipal IT company Kombit took down the national school communication platform. Belgium’s foreign ministry was an exception in its reasoning: it removed its sites after reports of attacks, yet Belgium’s national cyber centre registered no attacks on Belgian websites.
The Netherlands saw some of the widest disruption, The Next Web reported. The national cyber agency switched off its own website, and the Port of Rotterdam, the portal Overheid.nl, the five biggest political parties and many hospitals followed. NU.nl added NotuBiz, which municipalities, provinces and water boards use to publish notices, some services of the university network SURF and the website of the House of Representatives. Many sites were taken offline as a precaution, Le Monde also reported.
Not everyone went dark. NU.nl’s Rutger Otto noted that many non-Dutch sites stayed online, perhaps because their operators weighed the risk differently or did not use PHP. Erik de Jong of the security firm Tesorion told him a large web shop might reasonably stay up while a big team watched for break-in attempts. The exposure is wide: the tracker W3Techs puts PHP behind roughly three-quarters of websites whose language is known, The Next Web reported.
Christopher Kunz of heise online reports that every PHP version since PHP 5 contains the flaws. Routers, network storage devices and some security appliances also use PHP for their web control panels, he notes, so administrators should check those too.
Months of stalling, then a leak
In its own account, the Foundation says a core developer found signs of the memory-handling problem in 2024 while working on findings from an external security audit. At the time no one could show how an attacker would actually use it, so more obvious problems were handled first. The proposed repairs posed different risks: disrupting existing PHP applications, making servers easier to knock offline, or requiring extension maintainers to adapt their software. The Foundation called the delay “a structural failure” and linked it to both decision-making and limited staffing.
This summer the firm Calif began an audit on 30 July, sponsored by OpenAI’s Patch the Planet programme and, according to heise, run jointly with PHP’s Ecosystem Security Team. The Foundation dates Calif’s report of a flaw to 11 August and says OpenAI independently reported the same root cause. Calif’s own write-up describes its research and its work with the PHP Foundation. After the flaws’ identifiers leaked on 20 October, the Foundation says it moved the planned release forward by a day, from 22 to 21 October.
Dan Goodin of Ars Technica reported that the security firm watchTowr said it had confirmed the flaws were real. The Foundation says it created an Ecosystem Security Team in May, hired two more engineers over the summer and is moving security decisions to a majority vote; heise reports three security experts were hired. The Foundation is asking companies, hosting providers and governments to sponsor the work.
There is another side to the record. PHP release manager Volker Dusch told heise that the leak was regrettable, but that the team had been well prepared and had had time to coordinate and protect users as well as possible. Heise also notes that critical security flaws in PHP’s core have become comparatively rare: the last comparable one in the language core dates from 2017 (CVE-2017-5340).
Attempts are spreading; successful breaches are harder to establish
On 22 October, Adam Metcalfe-Pearce of F5 Labs reported that its sensors had recorded thousands of exploit attempts after disclosure, with scanning already visible before the patches were released. Those observations show targeting; they do not provide a verified count of organisations successfully compromised.
A day later, CrowdStrike researchers Jaime Duque and Brenden Conrad said their monitoring had found probing and unsuccessful attempts, but no successful exploitation. They said adapting an exploit to a particular PHP version and application remained a barrier. That finding describes CrowdStrike’s visibility, rather than proving that no attacks had succeeded elsewhere.
There is also a further warning. In a 23 October advisory, the PHP project described a separate code-execution flaw, CVE-2026-115560, that depends on an unusual combination of configuration and application behaviour. It said a fix would follow in the regular release cycle and advised affected operators to disable the session upload-progress feature in the meantime. This is separate from the two flaws fixed on 21 October; those updates do not resolve the newly described issue, Canada’s Cyber Centre confirmed in its 23 October update.
The sources reviewed here do not establish theft of personal data. Richard Verbeek of Fellowmind warned NU.nl that installing an update does not undo an earlier break-in. For European public bodies restoring services, the immediate question is whether they have also checked for intrusions. The longer one is whether they will help fund the security work on which those services depend.
