Shutting down out of caution, not because of an attack
Some institutional websites and digital infrastructures stopped working, but there was no cyber intrusion at the root: according to Chris Stokel-Walker in the Guardian, in most cases the operators themselves decided to take the services offline because keeping them active carried too high a risk. Among the cases cited are Dutch government websites, including the digital identity access system, Finnish public services and some systems of Wikimedia, the organization behind Wikipedia.
The stated cause is two serious vulnerabilities in PHP, the programming language underlying about 70% of traceable websites, according to the author. In practice, the flaws gave an attacker a pathway into online shops, customer data, passwords and payment pages. The UK National Cyber Security Centre advised organizations unable to update their systems immediately to consider disabling them.
A recurring vulnerability, with AI changing the scale
The article places the episode in a long series: the 2014 Heartbleed flaw in OpenSSL, the Log4j defect in 2021 and the backdoor inserted into XZ Utils three years later. In each of these cases, according to Stokel-Walker, small groups of developers identified and mitigated the problem, often with limited resources. The PHP Foundation admitted that the delay in fixing the flaw—identified as early as 2024 but judged too costly and complex to fix—was a “structural failure” linked to a lack of resources.
The new factor is automation. Researchers working with Calif, OpenAI and Wiz showed how easily the PHP vulnerability could be exploited with artificial intelligence tools, and according to Matthew Prince, chief executive of Cloudflare, his company has already recorded millions of exploitation attempts. The author also cites the growing volume of documented vulnerabilities: about 48,000 in 2025 and more than 84,000 in 2026, with two months still to go, or one every five minutes. Not all have the severity of this one, rated 9.2 on a scale of 10.
The unresolved issue: who pays for maintenance
The stated consequence is that similar episodes will recur, because AI makes it much cheaper to find weaknesses in large amounts of old code, while repairing them remains difficult. Stokel-Walker cites a 2025 UK government review according to which about 28% of the state’s core technology is classified as “legacy,” meaning obsolete, and some organizations did not even know how to quantify the dated software in use. In April, ministers reportedly admitted they could not provide a complete picture of how much had been fixed or decommissioned.
The author’s proposal is twofold: companies must know which software they use, including obscure components, and who is responsible for updates; adequate funding is also needed. As positive elements, he cites the €400,000-plus received by the OpenSSL Foundation from the German sovereign technology fund, the hiring of new staff by the PHP Foundation and the use of AI to distinguish relevant reports, as well as fixes already released by several organizations before public disclosure. However, the material does not verify which systems have been restored or on what timeline.
