Critical security vulnerabilities in PHP trigger global website shutdowns

On October 21, 2026, governments and organizations worldwide began taking websites offline following the discovery of severe security vulnerabilities in the PHP programming language. These flaws were identified through artificial intelligence, with the cybersecurity firm Wiz describing them as the most significant vulnerabilities ever detected by such technology. An official security update was released on Wednesday afternoon to address the risks.

In response to the threat, entities including the governments of Finland, Germany, Belgium, and the Czech Republic, as well as the Edinburgh City Council and the BBC, preemptively deactivated their online portals. While many of these organizations, such as Germany and Belgium, reported no actual breaches, they chose to suspend operations to install necessary patches. Japanese Prime Minister Sanae Takaichi urged all website owners to check their systems and apply the updates immediately.

Cybersecurity experts advised organizations unable to implement the patches promptly to consider temporary site shutdowns to prevent exploitation. The situation remains an active security effort as nations work to update their infrastructure and verify the safety of their networks against potential cyberattacks.