A large slice of the internet went dark on Wednesday — and most of it was switched off on purpose. Government websites in the Netherlands, France, Denmark and Finland were among hundreds taken offline on October 21 after two critical security vulnerabilities were found in PHP, the programming language that runs an estimated 70 percent of the world's websites, including WordPress, which powers roughly 43 percent of all sites.
The flaws, which researchers found with the help of artificial intelligence tools, had been hiding in PHP's code for more than a decade. They allow an attacker to read a server's memory or run code on it remotely, without ever logging in. The PHP project's developers released emergency patches on Wednesday afternoon, but exploitation attempts began within hours — security firm Cloudflare said it had already seen thousands of attempts and rushed out stopgap firewall rules while urging customers that only the patch itself was a real fix.
The U.S. National Security Agency warned organisations to prepare for the update and, together with Britain's National Cyber Security Centre, urged website operators to install the fix immediately — or take their systems offline until they could.
Governments chose darkness over exposure
Many governments took the second option. In the Netherlands, the National Cyber Security Centre set the example by disconnecting its own website, and a cascade followed: the central government portal Overheid.nl, the MijnOverheid citizen portal, the DigiD national digital identity system, the Port of Rotterdam, the national football association KNVB, the websites of the country's five largest political parties and several hospital sites all went down as a precaution.
In Finland, state IT provider Valtori took government public network services offline "as a precautionary measure." Denmark's municipal IT company Kombit shut down several services, including the national school communication platform. France's Interior Ministry placed all of its websites into preventive maintenance. Preventive shutdowns were also reported in Germany, Belgium and the Czech Republic, and the disruption reached beyond government: Wikipedia and the Internet Archive were briefly affected, according to reports, and Japan's prime minister Sanae Takaichi took to social media with "an urgent request for everyone to take action tonight." The episode, quickly nicknamed "PHP2Shell" in security coverage, was coordinated in part through alerts from the European Union's cybersecurity team, CERT-EU.
Why it matters
Most people have never heard of PHP, yet it is the quiet engine behind news sites, online shops, hospital portals and government services — which is precisely the problem. A single flaw in a ubiquitous, decades-old open-source codebase creates what security experts call monoculture risk: one bug, everywhere, all at once. Small websites run by individuals and organisations with limited technical staff are the most exposed, particularly on shared hosting where customers cannot patch the underlying server themselves.
The episode is also a preview of a new security era. The vulnerabilities were found by researchers using AI tools to audit old code at a scale humans never managed — the same capability available to attackers. Defenders won this round on speed: disclosure, patches, firewall rules and government shutdowns all landed within days. But the lesson agencies drew from October 21 is uncomfortable: when the next decade-old flaw surfaces, the race will again be measured in hours, and the safest website may be the one that can afford to go dark.
What happens next
Website operators have been told to inventory every PHP installation they run — including forgotten legacy applications — apply the patched versions, and review server logs for signs of attempted exploitation before bringing services back. Most government sites were expected back online once patched, but officials warned that restoring services safely takes longer than switching them off, and that the long tail of small, unpatched sites will remain a target for months.
*Reporting based on Reuters and CNBC coverage of the incident.*