PHP security flaw found by AI takes government websites offline in Europe; update your site now

PHP, the programming language behind a large share of the world's websites, released urgent security fixes on Wednesday 21 October 2026 after the cybersecurity company Wiz found critical flaws in it using artificial intelligence. Governments and companies in Europe took websites offline while they patched, Reuters reported in a story carried by Dawn and Business Recorder.

For readers in Pakistan the practical point is simple: if you own or run a website, check whether it uses PHP (most WordPress sites do) and ask your developer or hosting company to apply the fix today.

What was found

According to the Reuters report, the flaws had been hidden in PHP's code for years, possibly more than a decade. Wiz, which is owned by Google's parent Alphabet, said in a blog post that it found them with its own autonomous AI research tool, Wiz Atlas, alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Wiz said it worked with the PHP team, OpenAI and the security firm Calif on the discovery and on checking the patch. The report did not publish technical details or a CVE number.

The White House said it became aware of the flaw on Friday.

Who went offline

• Netherlands: the National Cyber Security Centre, the Port of Rotterdam, the government portal Overheid.nl, the football association KNVB, the websites of the five largest political parties and several hospitals.
• Denmark: the municipal IT company Kombit shut several services, including the national school communication platform.
• Finland: the state IT provider Valtori took public network services offline as a precaution.
• France: the Interior Ministry put all its websites into preventive maintenance.
• Elsewhere: Wikipedia's operator took down some systems, and Japan's Sakura Internet suspended a database feature. Japan's Prime Minister Sanae Takaichi told website owners to check whether their sites use PHP and prepare to apply the fix.

Security agencies in Europe, Australia, Japan and Britain told users to update immediately or take sites offline until they could. No Pakistani government site was named in the report.

What it means for you in Pakistan

Thousands of Pakistani small businesses, schools, clinics and shops run their websites on shared hosting, often on WordPress. Experts quoted by Reuters warned that shared-hosting sites, run by small organisations with limited resources, are likely to take longer to patch and stay exposed longest.

What to do today:

1. Ask your host or developer whether your site runs PHP and which version, and when the patched release will be installed.
2. Update PHP through your hosting control panel if you manage it yourself, then update WordPress, its plugins and themes.
3. If you cannot patch quickly, consider putting the site into maintenance mode, as several European bodies did, rather than leaving it exposed.
4. Watch for odd behaviour: new admin accounts, changed pages or unexpected redirects are signs of a break-in.

If your business is in our directory with a website link, a hacked site can also send your customers to scam pages, so it is worth a call to your developer tonight.

We will add the official PHP advisory and CVE numbers here once they are public.