Government websites in several European countries and Canada were pulled offline this week after the PHP Foundation issued a security release for two critical vulnerabilities in PHP, the server-side scripting language that underpins a large share of the public web. The outages were described as a preventive measure, not the result of a confirmed compromise, but they underscore how much of the internet's publishing stack depends on a single open-source runtime.

What was disclosed

The PHP Foundation announced the security release to patch two critical vulnerabilities. According to Reuters, governments in the Netherlands, Denmark, France and Finland took down at least some websites as a precaution. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, posted on X about the decision to temporarily take sites offline and repeated the call for any operator running PHP to update as soon as possible. In the United States, the Cybersecurity and Infrastructure Security Agency issued guidance encouraging organisations to apply the new patch, and the White House told Reuters it had been made aware of the issue on Friday.

Why a PHP flaw reaches so far

PHP is not a niche tool. It is the runtime behind WordPress and Drupal, two of the most widely deployed content management systems on the web, and it powers a long tail of custom applications, forums and internal portals. That reach is what makes a critical advisory unusual: patching a single library can mean touching thousands of independently operated sites. Tiffany Farriss, interim CEO of the Drupal Association, framed the scope bluntly, noting that servers running any version of PHP released in the last 20 years would be vulnerable and that the issue affects the majority of the internet.

The timing of the discovery is notable. Reporting indicated the flaws had existed in PHP's codebase for years and were only uncovered recently, with AI tools used by cybersecurity firms playing a role in surfacing them. That detail matters for engineering teams: automated code analysis is increasingly finding latent defects in mature, heavily audited open-source projects, compressing the window between discovery and exploitation and putting pressure on maintainers to ship fixes quickly.

The risk to operators

The vulnerabilities could allow an attacker to infiltrate a system running PHP and potentially take control of it. For defenders, the practical question is inventory. Organisations that know which PHP versions run where, and that can rebuild or redeploy affected services on short notice, are in a far better position than those relying on long-lived, hand-patched servers. The decision by several governments to take sites offline rather than run exposed code suggests they judged the availability cost lower than the risk of exploitation during the patching window.

Verification and next steps

The outages reported so far are a precautionary response, and the story is still developing. Operators should treat the PHP Foundation's security release as the authoritative source for affected versions and remediation guidance, and should verify the scope of their own exposure rather than relying on secondhand summaries. Applying the patch, confirming that PHP-FPM and web server processes have been restarted, and auditing logs for signs of exploitation are the immediate priorities. For the wider ecosystem, the episode is a reminder that the security of the web's shared foundations depends on how fast the organisations built on top of them can move when a critical advisory lands.