Dutch, Finnish and Wikimedia services go offline after unresolved PHP security flaws
Government websites and other internet services in the Netherlands, Finland and Wikimedia systems have been taken offline to reduce the risk of attacks exploiting two serious flaws in PHP. The episode shows how widely used digital infrastructure can become fragile when security problems are left unresolved, while AI tools help attackers find and exploit weaknesses faster.
PHP is used by about 70% of websites that can be tracked. The PHP Foundation said developers identified the issue in 2024, but fixing it was judged too costly and difficult, a delay it described as a “structural failure” caused by inadequate resources. Cloudflare’s chief executive said the company had seen millions of exploitation attempts; researchers counted about 48,000 internet vulnerabilities in 2025 and more than 84,000 so far in 2026.
In short
- PHP flaws prompted services to go offline.
- Attackers made millions of exploitation attempts.
- The author says chronic underfunding is the deeper problem.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Taking services offline can be justified when serious flaws are known and active attacks are under way: a temporary loss of access may prevent breaches, data theft or wider disruption. The episode also supports calls for better funding and maintenance of widely used software, since early fixes may reduce risks for governments, businesses and the public.
The case against
Taking public services offline can itself disrupt essential work and leave people without information or access, so the response should be proportionate to the specific exposure and use safeguards where possible. Given the cost and difficulty of fixing foundational software, critics may also argue that resources should prioritise verified risks and practical mitigations rather than treating every unresolved flaw as grounds for shutdown.
AI Americas Art Business Culture Government Markets Politics Software Technology World
Read the full article at the source →
Originally published by The Guardian as “Prepare for more website shutdowns in the age of AI – but human inaction is the real culprit | Chris Stokel-Walker”.