Two critical vulnerabilities found in PHP; government websites in the Netherlands, Denmark, Finland, France and other countries taken offline as an emergency measure

After critical vulnerabilities were found in the PHP programming language, government websites in many parts of the world were urgently taken offline on Wednesday, and PHP developers urged users to update as soon as a fix patch is released. As a result, the Nasdaq cybersecurity ETF rose 2.72% on Wednesday.

The importance of PHP

PHP is a programming language used to power websites. When a user visits a page, the PHP program on the server is responsible for assembling the content and transmitting it to the browser.

The cybersecurity company Huntress said in a blog post: "PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento websites, shared hosting platforms, control panels, and a large amount of software that does not advertise that it runs on PHP."

It is also one of the most widely used pieces of software on the internet. According to data from the web technology tracking tool W3Techs, PHP runs about 75% of websites whose programming language can be identified. It is the engine behind WordPress, which powers about 43% of all websites, from blogs and small business pages to government portals, online stores and news sites.

PHP developers said on Tuesday that they had discovered two critical vulnerabilities and urged users to update their websites as soon as fixes are available.

Security experts warn that these vulnerabilities could open the door for millions of servers, because many websites rely on the same underlying software. Attackers may not only target individual victims but also scan networks for systems running vulnerable versions of PHP.

Lukasz Olejnik, a visiting senior research fellow at King's College London, said the surge in AI-assisted hacking activity in recent weeks could exacerbate the threat. "With AI, exploitation can happen in an instant and at a larger scale," Olejnik said.

The risk is especially severe for small websites run by individuals or organizations with limited technical resources, especially shared hosting services where customers do not directly manage the underlying servers. Security experts say such websites may take longer to patch and remain exposed even after fixes.

A large number of websites urgently taken offline

On Wednesday, the U.S. cybersecurity sector strengthened, with Datadog up more than 6%, and Zscaler, Cloudflare and Okta up more than 5%.

Dani Nether, chief technology officer of the network and cloud security company Cloudflare, said attacks are beginning to accelerate and Cloudflare is updating firewall rules. "We are seeing early attacks and continuously updating mitigations as new vectors emerge. This is only a stopgap. Patch as soon as PHP releases an update," he said on social media.

As reports emerged that hackers were exploiting the vulnerabilities to breach websites, government agencies shut down their sites as a precaution before fixes. In the Netherlands, multiple organizations followed the National Cyber Security Centre in taking public-facing websites offline, including the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, the websites of the country's five major political parties, and several hospital websites.

Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.

Website disruptions were more widespread in Finland, where the state-owned IT service provider Valtori said government public online services had been taken offline "as a precaution."

France's Interior Ministry said it had temporarily shut down local government administrative websites pending security fixes.