A major and exceptional incident disrupted a significant portion of the global internet on Wednesday, October 21, after developers of the PHP programming language disclosed “critical vulnerabilities” exposing countless websites to cyberattacks. Government sites across Europe and the United States were pulled offline as a precautionary measure.
In France, reports of inaccessible public websites surged shortly after 3 p.m., according to the outage tracker DownDetector. The tax authority’s portal, the Paris police prefecture site, the Météo France weather service and the websites of nearly all French regional prefectures were temporarily unreachable.
“At the request of ANSSI, the Interior Ministry carried out preventive maintenance on all of its websites exposed to a critical security vulnerability,” the ministry said Wednesday afternoon, referring to the national cybersecurity agency.
Europe and the United States Also Affected
The disruption was not confined to France. In the Netherlands, the Dutch parliament, the national cybersecurity agency and the central government administration took their sites offline as a precaution. In Finland, the central government administration followed suit.
In the United States, the National Security Agency recommended an “immediate” update of numerous websites in a message posted on X. “This language has vulnerabilities that could provide direct access to the file system or database of servers,” the agency warned.
Developers Urge Immediate Patching
On Tuesday evening, PHP developers announced they had identified “two critical vulnerabilities” and urged users to “update as soon as it becomes available.” PHP underpins the architecture of a vast share of the web, including content management systems such as WordPress, Drupal, Joomla and Magento.
“This is a hyper-critical vulnerability. PHP is used across the entire planet — we are talking about 70% of websites worldwide,” said Guillaume Vassault-Houlière, founder of YesWeHack, one of France’s leading cybersecurity firms. “The flaw allows remote code execution — in other words, running computer code on a machine or server without physically accessing it.”
Once through the breach, an attacker “can take control, steal data, install malware and hijack accounts associated with the compromised site,” the specialist added.
First Attacks Already Detected
Some attackers have already sought to exploit the flaw, according to Dane Knecht, chief technology officer at the US cybersecurity firm Cloudflare. “We are observing the emergence of the first attacks and adapting our protections as new vectors appear,” he wrote on X, while stressing that such protections were only a temporary solution.
At this stage, all PHP versions from version 5 onward could be affected, though developers have not yet specified which ones are actually vulnerable. The disclosure has pushed cyber threat levels to their highest in recent months, with authorities on both sides of the Atlantic racing to patch systems before exploitation spreads further.
