Some of Wednesday’s biggest website outages were self-inflicted, and deliberately so. After the team behind the PHP programming language warned of two critical security holes, public bodies from Amsterdam to Helsinki decided that a dark homepage was safer than an exposed one.
Experts have bundled the two flaws under one catchy label, PHP2Shell. Both let an outsider run code on a web server without logging in, and both come from the same weakness: PHP can leave its memory in a broken state when a request ends badly. The discovery is credited to teams at Calif, OpenAI and Wiz. The PHP team said the danger was greatest for servers running Apache with mod_php, where an attack can fire before any website code is even loaded.
That matters because PHP sits underneath roughly three quarters of all sites whose technology can be identified, including every WordPress installation. Dutch reaction was the most visible. The country’s cyber agency went dark first, and Rotterdam’s port, the Overheid.nl portal, football’s KNVB and a number of hospitals copied it. Finland’s state IT provider Valtori pulled public services, France removed local government sites and Denmark’s Kombit shut a national school platform. At Cloudflare, engineers reported the first exploitation attempts within hours.
Patched builds for every supported branch, 8.2 up to 8.5, went live in the early afternoon European time. Versions 8.1 and older get no official builds, only small source patches. Security firm Wordfence pointed out that WordPress auto-updates will not help: the runtime on the server has to be upgraded, usually by the hosting company.
The worry now is the long tail of small sites on shared hosting that may stay vulnerable for weeks. Lukasz Olejnik of King’s College London warned that with AI tools, exploitation could happen almost instantly and at scale.
