Government agencies and companies around the world shut down websites today after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet
The US National Security Agency told organizations to patch immediately or pull vulnerable systems offline.
The flaws “often provide a direct path to the server’s file system or database,” the NSA said in a statement on X.
Attackers could use them to take over web servers without needing a password.
PHP sits underneath popular web design platforms so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services.
The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year’s record total.
“If you run PHP, it is imperative that you update now,” the PHP Foundation, which funds developers working on the language, said in a blog post.
In France, local government websites, including the Paris Police Prefecture, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, following “detection of a critical security vulnerability,” the Ministry of the Interior said.
In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity center went offline as a precaution, according to Dutch public broadcaster NOS.
Belgium’s foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.
AFP
Follow Us on Facebook – @LadunLiadi; Instagram – @LadunLiadi; Twitter – @LadunLiadi; Youtube – @LadunLiadiTV for updates
