PHP flaws forced government sites offline as AI speeds up attacks, expert warns
Dutch and Finnish public services and some Wikimedia systems were switched off over two PHP vulnerabilities, and a Guardian columnist says underfunded open-source upkeep is to blame.
At a glance
- Dutch government sites, Finnish public services and some Wikimedia systems were taken offline over two PHP vulnerabilities.
- The PHP Foundation identified the flaw in 2024 but delayed a fix, calling it a "structural failure" due to poor resourcing.
- Researchers logged over 84,000 internet vulnerabilities in 2026, and Cloudflare reported millions of exploitation attempts.
Government websites in the Netherlands, including the national digital ID login service, have been taken offline, Finland has suspended public services and Wikimedia has switched off some of its systems — not because of a cyber-attack, but because keeping them running was judged too risky. Writing in The Guardian, technology journalist Chris Stokel-Walker says the cause is two serious security vulnerabilities in PHP, the programming language he says is used by about 70% of the websites that can be tracked.
A window for attackers
The flaws effectively left an open window for hackers, the piece says: an attacker could break into an online shop, steal customers' addresses and passwords, or alter a checkout page to harvest card details. The UK's National Cyber Security Centre advised organisations that could not update immediately to consider taking their systems offline, which is what many did.
Stokel-Walker explains PHP by comparing it to the back-of-house team in a restaurant: the browser places an order, and PHP does the cooking and delivers the meal. Most readers, he notes, will have used a PHP-powered site this week without knowing it.
The same problem, a decade on
The author says the pattern is familiar. He reported on Heartbleed in 2014, a flaw in OpenSSL that was maintained on a shoestring by two men named Steve; on the Log4j logging tool in 2021; and on XZ Utils, a Linux file-compression tool into which a backdoor was deliberately planted. In each case, small, under-resourced teams spotted the problem and averted disaster.
The PHP Foundation has acknowledged that dynamic. Its developers identified the issue in 2024, but it was judged too expensive and too complicated to fix, and the foundation has since called the delay a "structural failure" caused by poor resource levels.
AI accelerates the search
What has changed, the piece argues, is automation. In August, researchers working with Calif, OpenAI and Wiz showed how easily the PHP flaw could be exploited using AI tools, and attackers moved quickly: Cloudflare chief executive Matthew Prince said his company had already seen millions of attempts to exploit it.
Researchers documented about 48,000 vulnerabilities across the internet in 2025, and more than 84,000 in 2026 with more than two months of the year still to go — one every five minutes, the piece says. The latest flaw scored 9.2 on the 10-point scale used to measure severity.
What should change
Stokel-Walker notes some positive steps. The OpenSSL Foundation received more than €400,000 from Germany's sovereign tech fund last year, and the PHP Foundation has hired more staff and is using AI to help triage what matters.
He also cites a 2025 UK government review that classed about 28% of central government technology as "legacy", with some organisations unable to estimate how much old software they had; in April, ministers admitted they could not give a comprehensive account of what had since been fixed or retired.
His conclusion: companies should document the software they depend on, including obscure components, and say who is responsible for fixing it. The big technology firms that profit from open-source code, and governments, should fund its upkeep — otherwise, he writes, there will be more days like these.
Source: The Guardian Business.
Questions and answers
- Why did government websites in the Netherlands and Finland go offline?
- They were deliberately switched off because of two serious security vulnerabilities in PHP, the programming language used by about 70% of trackable websites, which made keeping them online too risky.
- What is PHP and why does it matter?
- PHP is a programming language used by roughly 70% of websites that can be tracked. The Guardian compares it to a restaurant's back-of-house team: your browser orders and PHP cooks and delivers the meal.
- What does the author say should be done about it?
- Chris Stokel-Walker argues companies should document the software they rely on and who maintains it, and that big tech firms and governments should properly fund open-source upkeep.
