AI-Discovered PHP Flaws Force European Government and Health Sites Offline

Government, hospital, school and corporate websites across Europe went offline on October 21 as organizations moved to protect themselves from two newly disclosed flaws in PHP, the programming language that underpins a large share of the web. Among the sites taken down were those of the Port of Rotterdam, the Paris police force and the Finnish health agency, along with Dutch parliament and several public bodies in the Netherlands.

What was found in PHP

The flaws were officially disclosed with accompanying fixes, and both appear to have sat in the language for more than a decade before being uncovered with the help of AI tools, according to reporting on the disclosure. The organization that maintains PHP confirmed it was preparing to announce two major vulnerabilities alongside patches. Because so much of the web runs on the language, used by as much as 70 percent of websites, the exposure is unusually wide.

The U.S. National Security Agency advised organizations running PHP to update immediately or take systems offline until they could, according to accounts of the guidance. In the Netherlands, the national cyber security center pulled its own site and told companies to update PHP as quickly as possible, warning that any internet-reachable system containing the language is probably vulnerable until it is patched. Ordinary users felt the effects too: subscription sign-up and management was temporarily unavailable at newspaper titles owned by DPG Media, a system used by a hundred municipalities for meetings was taken down, and a bus company's site went dark.

Exploitation attempts already seen

Cloudflare, which acts as a protective layer in front of many popular sites, said it had already observed the first attacks and that its systems were intercepting attempts to abuse the flaw, though it acknowledged that filtering is not a guarantee. The Dutch cyber security center said it had not yet confirmed active abuse. The Dutch parliament's website and several systems in higher education were also pulled offline, although it was not immediately clear which institutions were affected.

The disclosure landed alongside several other security events on the same day. The developers of Node.js, the open-source JavaScript runtime used by close to half of software developers, published fixes for four high-severity vulnerabilities, one of which allowed remote code execution and two of which could have let attackers bypass TLS checks meant to verify a server's identity. A widely used open-source proxy for routing requests to multiple AI model providers was compromised after an attacker injected malicious code, published through package and container registries, that included an information stealer targeting cloud and AI service credentials. Separately, an Indian certificate authority had private keys compromised, a problem one specialist described as a cleanup job larger than the Heartbleed episode.

What it means for technology careers

For application security teams, the episode underlines how quickly disclosure now turns into pressure. Web security work has shifted from periodic patching toward rapid triage, since a flaw can go from a public forum post to attempted exploitation within hours. The event also points to a widening skills demand: the weaknesses were reportedly surfaced with AI tools, the same technology attackers are expected to lean on to write exploit code faster. Analysts say that raises the value of practitioners who can read unfamiliar code, assess severity under time pressure and apply fixes without breaking live systems. Roles covering secure software development, dependency management and incident response are likely to see sustained demand as organizations review how much of their estate depends on aging open-source components.

The coming days will show whether the PHP patches close the window cleanly. Organizations are expected to audit internet-facing systems for the vulnerable versions, review logs for attempted exploitation, and check whether any of the other releases, including the Node.js fixes and the compromised AI proxy packages, touched their infrastructure. For workers in development and operations, the immediate task is verification: confirming which systems were pulled offline, which were patched and which remain exposed while the permanent fixes propagate.