The Dutch National Cyber Security Center (NCSC) has gone offline because it runs on PHP, after the PHP Foundation issued a security release to patch two critical vulnerabilities in the widely used web programming language. The center's own site now carries an urgent warning telling anyone using PHP in websites or web applications to install the updates as soon as possible.
The outage is the sharpest illustration of a global scramble: government websites in the Netherlands, Denmark, France, Finland and Canada were taken down as a preventive measure, according to Reuters. The story matters because PHP underpins a large share of the web, including publishing platforms such as WordPress and Drupal.
What the PHP vulnerabilities actually are
The flaws sat unnoticed in PHP's software for years and were only uncovered with the help of AI tools used by cybersecurity firms. A hacker exploiting them could infiltrate a server running PHP and potentially take control of it.
OpenAI said the vulnerabilities, found using GPT-5.6 Sol, are "among several significant vulnerabilities" it has identified, and that it expects "similar findings to increase sharply." The PHP Foundation has released patches, and the message from authorities is consistent: install them immediately.
How far the PHP outage reaches
The impact is unusually broad. Tiffany Farriss, interim CEO of the Drupal Association, said "all servers using any version of PHP released in the last 20 years will be vulnerable" and that the issue "impacts the majority of the Internet."
Governments reacted fast. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, posted on X about the decision to temporarily go offline and backed the call for site operators to update right away. In the United States, the Cybersecurity & Infrastructure Security Agency urged organizations to apply the new patch, and the White House told Reuters it was made aware of the issue on Friday.
