Verified Evidence: resolved · Fact Lock: locked · QA: pass
Government agencies, companies and other website operators in multiple countries temporarily took sites offline while working to patch critical security flaws identified in PHP, a programming language used by roughly 70% of websites.

The precautionary shutdowns were reported on and around October 21, 2026, with follow-up coverage published on October 22. The Guardian Business said Dutch, German, Belgian, Finnish and French government websites were among those temporarily taken offline as operators worked to address the PHP weaknesses. The South China Morning Post separately reported shutdowns involving government agencies and companies around the world.

The reports differ in how they describe the issue: The Guardian Business referred to a serious vulnerability, while the South China Morning Post and Al Jazeera described two critical vulnerabilities. All three reports agreed that PHP is used by roughly 70% of websites, giving the incident significance beyond any single service or country.

Artificial intelligence was used to pinpoint or expose the two vulnerabilities, according to the supplied reporting. The South China Morning Post reported that Wiz was one of the security firms that found the issues, although that role is supported in the supplied material by that report alone.

The potential reach of the problem extends across different types of online services. The South China Morning Post reported that the weaknesses could affect online stores, news outlets and government services. That scope remains a reported possibility, rather than evidence that every such service was affected.

German security officials and politicians described the development as a major turning point for IT security, according to Handelsblatt. Germany was among the countries mentioned in coverage of the shutdowns, but the supplied evidence does not establish it as the overall center of the incident.

The available material does not provide technical details about the vulnerabilities, the precise number of websites taken offline or confirmation that attackers actively exploited the flaws. It also does not include an explicit official confirmation from PHP maintainers or a government authority. The immediate response described in the reports was precautionary: operators took services offline while working to patch the weaknesses.

SOURCES

  1. South China Morning PostWebsites go dark worldwide as AI exposes critical security flaws
  2. The Guardian BusinessFlaw in PHP computer language leads to shutdown of websites around world
  3. HandelsblattProgrammiersprache PHP: PHP-Sicherheitslücke alarmiert Sicherheitspolitiker
  4. Al JazeeraWorld leaders warn of security flaws found in PHP programming language