AI-discovered PHP flaws force government websites offline across Europe

Government agencies across Europe took websites and services offline after security flaws were found in PHP, the widely used web programming language. Agencies in the Netherlands, France, Denmark and Finland were among those that temporarily shut down sites as a precaution while administrators rushed to install security updates.

In Denmark, the municipal IT company Kombit shut down several services, including a national school communications platform. In Finland, Valtori, the state IT services provider, took government public-network services offline. France's Interior Ministry placed all of its websites into preventive maintenance.

The flaws are already being targeted. Technology companies have detected attempts by hackers to exploit them. Data from the internet-intelligence company Censys shows the scale of the problem: of 2.6 million detected hosts, about 1.5 million were reporting PHP versions for which no fix was yet available at the time of the data. That leaves a large number of sites exposed while patching continues.

The vulnerabilities had been hidden in PHP's code for more than a decade. They were independently discovered by cybersecurity researchers using artificial intelligence, which makes this a case of AI turning up long-standing weaknesses in core internet software, with immediate consequences for public services in the Nordics and elsewhere in Europe.