# Governments take websites offline to patch two critical PHP flaws

Japan's prime minister and senior ruling-party officials suspended their sites, because the leaked flaws let attackers run code on servers without logging in.

- Published: 2026-10-22T05:18:53.241Z
- Canonical: https://polylog.news/2026-10-22/governments-take-websites-offline-to-patch-two-critical-php
- Publisher: Polylog (Global desk)
- Section: tech
- Sources: [Financial Times Technology](https://www.ft.com/content/d438af1e-a48c-4aeb-8c84-00cdb5e741e3?syn-25a6b1a6=1), [MercoPress](https://en.mercopress.com/2026/10/22/global-alert-over-two-critical-php-flaws-forces-government-websites-offline?utm_source=feed&utm_medium=rss&utm_content=main&utm_campaign=rss), [Jiji Press](https://www.jiji.com/jc/article?k=2026102200278&g=pol)

Governments and companies in several countries [temporarily took websites offline](https://en.mercopress.com/2026/10/22/global-alert-over-two-critical-php-flaws-forces-government-websites-offline?utm_source=feed&utm_medium=rss&utm_content=main&utm_campaign=rss) this week, MercoPress reported. The cause was two critical vulnerabilities in PHP, the programming language behind much of the web. Both allow an attacker to run code on a server without authenticating. In Japan, Prime Minister Sanae Takaichi and senior figures in the Liberal Democratic Party (LDP) [suspended their home pages](https://www.jiji.com/jc/article?k=2026102200278&g=pol), Jiji Press reported.

The [Financial Times](https://www.ft.com/content/d438af1e-a48c-4aeb-8c84-00cdb5e741e3?syn-25a6b1a6=1) reports that government security agencies told companies to act immediately after AI tools uncovered widespread vulnerabilities. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert saying the flaws [require immediate patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching). According to [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities) and [Huntress](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities), details leaked online on October 20, before coordinated disclosure and before fixes existed. PHP released patched versions on October 21. Any server running PHP for web requests is exposed. That includes sites built on WordPress, Drupal and Magento.

The episode reverses the usual order of events. Disclosure normally comes after patches are ready, but here attackers and defenders received the details at the same moment. Security firm [Patchstack](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/) reports that attacks are already under way. Administrators of small government and business sites, who often update slowly, have the most to lose.

## What this means

When AI tools can find flaws in core internet software faster than maintainers can fix them, the cost of security shifts onto everyone who runs older systems. Governments, small businesses and hosting firms pay through downtime and emergency patch work. Managed cloud providers and security vendors gain, because customers move workloads to platforms that patch for them. Consensus treats this as a one-time incident. If the FT account of AI-driven discovery is correct, similar disclosures in other widely used languages and libraries are likely to follow at shorter intervals. The 2021 Log4j flaw is the precedent: it produced exploitation that lasted for years on servers never patched, as well as new regulatory requirements. The likelier outcome within months is binding patch deadlines from US and European regulators for public bodies, and faster migration to managed hosting. Evidence that the flaws were found by human researchers without AI help would weaken the case that this will recur.

## What to watch

- Reports of large data breaches traced to the PHP flaws in the coming weeks, which would show how many servers missed the patch.
- Whether AI developers or security firms disclose other core-software flaws found by AI. That would confirm that discovery is getting faster.
- New patch-deadline rules for government agencies in the United States, the European Union or Japan, which would turn this into a compliance cost.