Government agencies in Europe have temporarily taken websites offline following the discovery of two critical security vulnerabilities in PHP, a programming language that powers a large share of the internet.

Finland, the Netherlands and France were among the countries that took precautionary measures as cybersecurity officials warned that the flaws could allow attackers to execute malicious code on vulnerable servers.

Among the affected platforms was the Netherlands’ National Cyber Security Centre (NCSC), the country’s own cybersecurity agency. Other Dutch services temporarily taken offline included government portals Overheid.nl, MijnOverheid.nl and DigiD. French authorities also temporarily took local government administrative websites offline while awaiting a security fix.

Two Critical Vulnerabilities Discovered

The vulnerabilities affect PHP, a widely used server-side programming language that enables websites to process information, handle user requests and communicate with databases.

According to reports, the flaws could allow unauthenticated attackers to execute their own code on vulnerable servers, potentially exposing sensitive information, compromising websites or giving attackers control of affected systems.

Cybersecurity firm Cloudflare reported seeing early attempts to exploit the vulnerabilities and introduced temporary defensive measures while urging organisations to install the official security updates as soon as they became available.

Emergency Security Updates Released

PHP developers released security updates on October 21 to address the two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

The updates include PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website operators have been urged to apply the appropriate fixes immediately and verify that their hosting environments are protected.

The European Union’s cybersecurity response team, CERT-EU, had advised organisations unable to patch affected systems promptly to consider taking vulnerable websites offline as a precaution.

Why the Vulnerabilities Matter

PHP is one of the internet’s most widely used programming languages and underpins popular content management systems, including WordPress, Drupal and Joomla.

Its extensive use means a vulnerability in the language can have consequences far beyond government websites, potentially affecting news publishers, businesses, online stores and other organisations that rely on PHP-powered platforms.

For website owners, the incident highlights the importance of keeping server software updated, coordinating with hosting providers and responding quickly to critical security advisories.

The temporary shutdowns were precautionary measures intended to reduce exposure while organisations secured their systems. The discovery of a vulnerability does not, by itself, mean that a particular website has been breached.