Critical security vulnerabilities found in PHP programming language trigger global website shutdowns

On Wednesday, October 21, 2026, governments and organizations worldwide proactively took websites offline following the discovery of two critical security vulnerabilities in the PHP programming language. These flaws, identified with the help of artificial intelligence, could allow attackers to execute remote code, posing a severe risk to sensitive data and infrastructure. Security firm Wiz described these as some of the most significant vulnerabilities ever identified.

In response to the threat, entities including the governments of Finland, Germany, Belgium, and the Czech Republic, as well as the Edinburgh City Council and the BBC, temporarily suspended their online services. The FBI and the NSA issued formal warnings, urging administrators to apply security patches immediately or shutter their sites if updates could not be performed right away. Japanese Prime Minister Sanae Takaichi also publicly called for urgent site assessments.

While the PHP Foundation has released security updates to address the flaws, organizations remain in a state of alert. Although no successful mass attacks have been confirmed, authorities maintain these precautions to prevent potential exploitation. Experts continue to monitor the situation as teams worldwide work to apply the necessary patches to protect the vast infrastructure that relies on PHP, which powers approximately 70% of websites globally.