Websites taken down across Europe ahead of critical cyber-security update

Several European governments and agencies have taken public websites offline ahead of a scheduled security update for the PHP programming language after two critical vulnerabilities were disclosed. National cyber centres in the UK, EU, Australia and Japan urged immediate application of the fixes or temporary shutdowns where patching is infeasible; Finland and parts of the Dutch government, including the national health institute and the lower house of parliament, made services inaccessible as a precaution. The move reflects warnings from incident-response teams that the flaws present a high-priority threat and that early exploit activity is already being observed.

The vulnerabilities are reported to allow unauthenticated remote code execution, enabling attackers to install malware or disrupt websites and services. PHP underpins a large share of the web - content management systems like WordPress, Drupal and many shared hosting and control-panel products - so finding every instance and bundled copy is complex. Cloudflare and other security firms report emerging attacks and are updating mitigations. Authorities recommend immediate patching, continuous monitoring for signs of compromise, and checking third-party appliances and services that bundle PHP. CERT-EU indicated the issue could affect PHP versions going back to PHP 5 (released in 2004), increasing the remediation scope and urgency.