Government Websites Shut Down Simultaneously as Intelligence Agencies Step In

Jakarta, CNBC Indonesia — A vulnerability stemming from a security flaw in the PHP server-side programming language has affected numerous parties. Government websites in Europe were among those taken offline simultaneously on Wednesday (21 October 2026).

The websites were disabled amid fears that the vulnerability could spread across servers hosting sites built with PHP.

The US National Security Agency also warned millions of organisations to install software updates or disable their servers.

Matt Suiche, a researcher at cybersecurity start-up Tolmo, said the urgency surrounding the issue was unprecedented, given that everyone now has enhanced capabilities through AI.

“The reason there is a sense of urgency now is that everyone has enhanced capabilities with AI, not only defenders but attackers as well,” Suiche said, as quoted by CNBC International on Friday (23 October 2026).

The PHP vulnerability was not entirely new. Two years ago, Mihail Kirov, then an engineer at Quarkslab, discovered a vulnerability caused by the same issue as the current case.

The PHP Foundation was informed of the system weakness at the time, but no fix was ever released.

In a blog post, the PHP Foundation later acknowledged that the delay amounted to a structural failure, attributing it to the security team’s decision-making process and a lack of resources.

Regarding the latest issue, PHP Foundation executive director Elizabeth Barron said the organisation was continuing to monitor the situation. She also said there was so far no evidence of a successful attack.

“There have only been incomplete, misdirected and non-functional exploits,” she said.