Two critical vulnerabilities in PHP, a programming language widely used across the internet, prompted public institutions and other European organisations to temporarily suspend their websites on Wednesday, 21 October. The flaws, discovered with the assistance of artificial intelligence, can allow attackers to take remote control of servers, and Cloudflare has already detected active exploitation attempts.

CERT-EU, the cybersecurity service for European Union institutions, recommended the immediate application of patches. Where updates are not immediately possible, it advised organisations to consider isolating internet-facing applications until systems are patched and remediation has been verified.

The vulnerabilities, collectively known as “PHP2Shell”, allow malicious code to be executed on affected servers without prior authentication. An attacker could thereby access sensitive data, disrupt services, or use the compromised server as a launchpad to penetrate other systems within the same network.

The PHP development team released fixes on 21 October, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and called for immediate updates. Developers warned that alternative protective measures are incomplete and that updating to a patched version remains the only secure solution.

According to Reuters, websites were suspended in Germany, France, Belgium, Finland and the Netherlands. Affected services included government portals, hospitals, schools and a range of other organisations.

In the Netherlands, the suspension covered the Port of Rotterdam, the public portal Overheid.nl, the national football federation and several political parties. In Finland, the state information technology centre described the interruption of digital public services as a precautionary measure and said it had not identified any exploitation attempts. German authorities similarly indicated that the suspension of their websites did not result from any known security incidents.

Cloudflare, which provides internet infrastructure and security services, confirmed that it had observed attack traffic targeting its customers and attempts to circumvent implemented protections. The company reinforced its filtering mechanisms but stressed that these do not substitute for the installation of official patches.

The flaws reside in the PHP software itself. Updating only a website’s code or its additional modules therefore does not resolve the problem: the underlying PHP version supporting the applications must be updated, in coordination with the hosting provider where applicable.

OpenAI disclosed that research firm Calif identified one of the vulnerabilities using one of its AI models, while Wiz discovered and independently reported both flaws. Wiz participated in coordinating the response and described the case as one of the most significant security issues in recent times, citing both the severity of the vulnerabilities and the widespread use of PHP.

In the United States, the FBI’s cybersecurity division and the National Security Agency (NSA) also issued alerts. In addition to updating systems, they recommended monitoring for suspicious activity and temporarily suspending any services that cannot be immediately secured.