PHP2Shell flaw forces government sites offline across Europe

The Netherlands took DigiD, its national login system for government services, offline on October 21, along with the government records portal MijnOverheid. The Port of Rotterdam, the football association KNVB, the country's five largest political parties and many hospitals went dark alongside them. Government sites in Belgium, Finland, France and Germany pulled themselves offline the same day while administrators waited for a patch to one of the most widely used pieces of software on the internet.

The PHP Foundation shipped emergency fixes for two remote-code-execution bugs, together called PHP2Shell, that according to the Guardian could "provide a direct path to the server's file system or database" of any site running old PHP code. The language is "used by almost 70% of websites." "There's going to be a lot of automatic exploitation of this," Michał Woźniak told the paper.

Security firm Calif found the first bug in August using OpenAI's GPT-5.6 Sol model during an audit funded through OpenAI's Patch the Planet initiative. Google-owned Wiz said it uncovered the flaws independently weeks later, using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. "The vulnerabilities remained hidden in the PHP codebase for more than a decade."

Amazon Threat Intelligence recorded a first exploitation attempt on October 17, four days before the fix shipped.