LONDON: Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.

Developers of the PHP programming language said on Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released. On Wednesday, they said, a new version fixing the vulnerabilities was live.

But with reports that hackers were exploiting the flaws to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline ahead of the fix as a precaution.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

Wordfence, a security plugin, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix.

Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution due to the vulnerabilities.

Published in Dawn, October 22nd, 2026