A critical set of vulnerabilities in PHP, the programming language powering roughly 70-75% of the web, sparked a global security scramble on Wednesday, 21 October, forcing government agencies across Europe to take websites offline as developers raced to release a patch. According to security firm Wiz Research, which disclosed the vulnerability, hackers could exploit these bugs to execute remote code and access sensitive information stored in memory on impacted servers, including passwords, API keys, and tokens.

All PHP versions launched within the last decade since 5.4 are affected by the bugs. The flaws have been identified through two CVEs with a severity CVSS score of 9.2.

A patched version was made available for PHP developers around 1345 GMT on Wednesday; however, before the release, several sites went down for safety reasons, including websites of the Dutch national cybersecurity agency, the Port of Rotterdam, the Dutch government portal, the KNVB football association, hospitals, and political party sites.

Finland's state IT provider Valtori also pulled offline government services, as did Denmark's Kombit, which shut down the national school communication platform. In France, the Interior Ministry also took down administrative sites of local governments.

Security experts have urged all hosting providers and website administrators to apply the security updates immediately to prevent potential data breaches and widespread service disruptions. The rapid response from the developer community helped mitigate further damage, though investigations into the extent of attempted exploits are still ongoing across multiple jurisdictions.

Authorities have emphasized that continuous monitoring of server logs will be crucial in the coming days to detect any lingering unauthorized access attempts. This incident highlights the delicate nature of global internet infrastructure, where a single software vulnerability can instantly disrupt vital public and private services across multiple continents.