October 21, 2026

Government Websites Across Europe Go Dark Over Critical PHP Flaws

By The Night Desk

Headline card by The Night Desk

Government Websites Across Europe Go Dark Over Critical PHP Flaws

Several government, school and hospital websites across Europe went offline on Wednesday as organizations rushed to protect themselves from two critical security flaws in PHP, a programming language that powers a huge share of the internet — including WordPress, the software behind roughly 40% of all websites.

PHP's developers released emergency updates fixing the two vulnerabilities and strongly urged users to install them immediately.

What the flaws allow

EU cybersecurity officials rated both vulnerabilities 9.2 on the CVSS severity scale — a rating that indicates a risk of unauthenticated remote code execution, meaning attackers could potentially run malicious code on vulnerable servers without logging in. The U.S. National Security Agency warned such flaws often provide "a direct path to the server's file system or database."

CERT-EU, the EU's cybersecurity response team, advised organizations unable to patch in time to take affected sites offline. The U.S. NSA said organizations that can't update immediately should pull systems offline until fully mitigated.

What's offline

• Netherlands: The Port of Rotterdam, government site Overheid.nl, the national football association KNVB, the websites of the five largest political parties and numerous hospital websites were preventively taken offline, following the National Cyber Security Centre's example.
• Germany: Federal IT provider ITZBund took several government websites offline as a purely preventive measure; no security incidents were known, officials said.
• France: The Interior Ministry temporarily took prefecture websites — local government administrative offices — offline pending a security fix.
• Belgium: The foreign ministry took its websites offline following reports of cyberattacks exploiting the PHP flaws, though the country's cybersecurity centre said it had not recorded attacks on Belgian sites.
• Finland: State IT centre Valtori shut down the government's public web services as a precautionary measure, saying the outage was not the result of a data breach.
• Wikimedia: The foundation behind Wikipedia said it was addressing the vulnerabilities across its systems and had taken down other systems as a precaution until they can be safely patched.

Early attacks emerging

Cloudflare said it was seeing early attacks emerging in the wild. Australia's cyber agency said it was not aware of active exploitation as of Wednesday. Web hosting provider GoDaddy warned the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

This story is developing. The Night Desk will update as patches roll out and systems come back online.

Source: Reuters (multiple reports, Oct. 21, 2026)

Source: Reuters — read the original report