Why Government Websites Are Going Offline Worldwide: The Critical PHP Security Crisis Explained

Updated October 22, 2026. This article distinguishes confirmed incidents from unverified causes of individual outages. Service availability may change as administrators finish security work.

If you tried to open a government website this week and encountered a maintenance message, a blank page or an unavailable service, you are far from alone. Government portals, hospitals, educational institutions and other organizations across several countries have temporarily taken websites offline amid an unusually serious software security alert.

The central issue is two critical vulnerabilities in PHP, the programming language behind a substantial share of the web. On October 21, 2026, PHP maintainers released emergency fixes. Cybersecurity authorities urged organizations to patch promptly and to consider isolating vulnerable systems when they could not do so in time.

The crucial distinction: an offline website does not automatically mean it was hacked. Several reported shutdowns were precautionary measures. Here is what is verified, what remains uncertain in Morocco, which services were named, and what website owners should do.

1. What happened to PHP on October 20–21, 2026?

On October 20, the PHP security team announced that it had identified two flaws requiring an emergency release. Both received a critical CVSS 4.0 rating of 9.2 out of 10. The following day, the maintainers published fixed builds for the maintained PHP branches.

The vulnerabilities are designated CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution under affected conditions. In plain language, an attacker may be able to make a vulnerable web server run malicious instructions without logging in first.

PHP runs on the server rather than in the visitor’s browser. It can process forms and uploaded files, create sessions, generate pages and communicate with databases. That is why flaws inside its runtime can potentially affect information and functionality beyond the visible page.

• CVE-2026-109618: A memory-corruption problem involving out-of-memory handling while request data can be incompletely initialized.
• CVE-2026-109619: A problem involving stale internal state after related memory has been freed, creating dangerous conditions across requests.
• Deployment exposure: The official advisory warns about web-serving PHP installations, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed; the highest demonstrated risk was identified for certain mod_php configurations.

This is not merely a WordPress plugin bug or a cosmetic error. Yet PHP adoption is not the same as confirmed vulnerability or compromise. Real exposure depends on the runtime version, vendor backports, configuration and whether the patches have actually been installed. Read the official PHP security advisory and CERT-EU assessment for technical details.

2. Why would governments deliberately shut down websites?

Government systems can handle identity information, procurement documents, administrative procedures and other sensitive services. When the risk of unauthorized server access is severe, a temporary interruption may be safer than leaving a potentially vulnerable service exposed to the internet.

CERT-EU advised organizations to patch affected systems immediately. If fixes could not be applied promptly, it recommended considering isolation of internet-facing applications until installation and verification were complete. Administrators may use this period to take backups, install updated packages, restart workers, test critical functionality and examine logs for suspicious activity.

A maintenance screen can indicate a preventive security decision—not evidence of a successful cyberattack.

There is also no single switch controlling all government websites worldwide. Each institution has different hosting arrangements, software versions and maintenance processes. Some websites are affected, others continue operating, and still others can fail for unrelated reasons such as network problems or scheduled infrastructure work.

3. Which government websites and organizations went offline?

International coverage on October 21 identified the following confirmed examples. These are reported precautionary actions or disruptions at the time, not a real-time list of sites that remain offline on October 22. The details below are based principally on Reuters reporting.

France: Prefecture websites

France’s Interior Ministry said websites for prefectures—local state administrative offices—were temporarily disabled while the organization awaited a security fix for the PHP framework used. This affected access to administrative information, although the measure was characterized as precautionary rather than evidence that each portal had been breached.

Germany: Federal government services

Germany’s federal IT provider ITZBund took several websites offline. A digital ministry spokesperson said this was preventive and that no related security incidents were known at the time of the statement.

Netherlands: Overheid.nl, the Port of Rotterdam and hospitals

Organizations in the Netherlands adopted protective shutdowns, with reports naming the government information portal Overheid.nl, the Port of Rotterdam, the KNVB football association, websites of major political parties and numerous hospitals. These examples demonstrate that a shared software vulnerability can disrupt public, commercial and civic services alike.

Finland: Government web services

Finland’s state IT service provider Valtori temporarily disabled public government web services. It described the move as precautionary and said that it had not identified exploitation attempts or a data breach at the time of its announcement.

Belgium: Foreign Ministry websites

Belgium’s Foreign Ministry temporarily took websites offline amid reports of attacks exploiting the vulnerabilities. The national cybersecurity center nevertheless stated that it had not recorded attacks on Belgian sites at the time. Concern about exploitation is not the same as a confirmed breach.

Czech Republic: Government website

The Czech government took its website offline on October 21 on the recommendation of its cybersecurity watchdog so that necessary security updates could be installed before normal access resumed.

Wikimedia: Selected systems

The Wikimedia Foundation, which supports Wikipedia and other projects, said it was addressing PHP vulnerabilities and had temporarily disabled several systems. That does not establish that every Wikipedia page or service was continuously unavailable.

Reported interruptions are a snapshot, not a guarantee of current status. The authoritative source for whether a particular service is working again is the organization operating that service.

4. What is happening to Moroccan government websites?

Morocco is relevant to this incident because PHP is widely used in its web ecosystem. On October 21, Moroccan outlet Médias24 reported that the Direction Générale de la Sécurité des Systèmes d’Information (DGSSI) had issued a critical alert about the PHP vulnerabilities, sometimes called PHP2Shell. The report said proof-of-concept exploit code was available.

Médias24 also cited W3Techs data indicating that 75.4% of sampled .ma websites whose server-side language could be identified use PHP. This measures technology adoption, not the proportion of Moroccan websites that are vulnerable, compromised or offline. It also excludes websites whose language could not be identified and Moroccan websites using other domain extensions.

Why is marchespublics.gov.ma not working?

Morocco’s official public procurement portal, marchespublics.gov.ma, is important for companies searching for tenders, accessing documents and submitting responses. If it displays a maintenance page or fails to load, the international PHP incident is one plausible context worth investigating.

However, as of October 22, 2026, we have not independently verified an official statement linking a specific outage of marchespublics.gov.ma to these vulnerabilities. We therefore cannot responsibly claim that PHP2Shell is the confirmed cause of the portal’s unavailability. The same caution applies to other individual Moroccan government websites.

If a deadline or public service is affected, users should check announcements from the responsible government body, retain evidence of access difficulties where relevant and avoid unofficial replacement websites or unsolicited messages that claim to restore access.

5. Why does one programming language affect so many institutions?

PHP has supported the web for decades. It powers many content-management systems and applications, including WordPress, Drupal, Magento-based commerce installations and countless custom business systems. Its broad hosting support, mature ecosystem and accessibility helped it become a common choice for public and private websites.

The advantage of shared foundations is efficiency: organizations can build quickly using proven technology. The tradeoff is correlated exposure. When a severe vulnerability appears in a common runtime, many independent organizations may suddenly need upgrades at the same time.

That does not mean PHP is inherently unsafe or should automatically be abandoned. No major software ecosystem is immune to vulnerabilities. The meaningful questions are whether systems are on supported releases, whether vendor updates reach production quickly, who owns maintenance and whether recovery procedures work.

A polished website can conceal an outdated server stack. Visual quality and technical security are separate disciplines that need to reinforce one another.

6. How did artificial intelligence help uncover the PHP flaws?

The incident also marks a notable development in security research. In a public account of its Patch the Planet initiative, OpenAI said that the organization Calif identified a critical PHP flaw using GPT-5.6 Sol. Cybersecurity company Wiz independently discovered and reported both vulnerabilities.

PHP maintainers led the fixes and release, while OpenAI, Wiz, Cloudflare and other partners helped with research, validation, coordination and preparation for public disclosure. OpenAI said the collaborative response had taken place over roughly two months before the patches became public.

The implication is larger than this particular event. AI-assisted tools may help defenders discover subtle weaknesses before attackers do. The same accelerating capabilities can also be misused to search for flaws and develop exploits. A vulnerability being found earlier gives defenders an opportunity—but only if organizations actually deploy fixes.

Businesses should resist both sensational extremes: this was not proof that all websites had been hacked by AI, and it was not a trivial maintenance update. It was a severe, widely relevant security issue requiring coordinated technical action.

7. What should website owners and businesses do now?

Identify your actual PHP runtime

Ask your technical team or hosting provider which PHP version serves production traffic. This may not match the version installed on a laptop or displayed by a local development tool. Managed hosts should be able to confirm their response to the October 2026 advisories.

Install the correct security updates

The upstream PHP releases published on October 21 were:

• PHP 8.5 → 8.5.12
• PHP 8.4 → 8.4.27
• PHP 8.3 → 8.3.36
• PHP 8.2 → 8.2.35

Linux distributions and long-term-support vendors may supply backported security fixes with different package version numbers. Follow vendor advisories rather than relying solely on the upstream number. PHP 8.1 and older no longer receive ordinary security releases directly from the PHP project, although some vendors offer maintained backports. A supported upgrade path is strongly preferable.

Reduce exposure if patching must be delayed

Where an immediate update is impossible, CERT-EU recommends considering isolation of internet-facing applications. The PHP maintainers describe partial mitigations for particular attack paths but warn that updating is the only complete fix. Emergency server changes should be directed by qualified administrators; a generic firewall rule or a WordPress plugin update alone is not sufficient assurance.

Back up, validate and monitor

Maintain recoverable backups of application files, databases and configurations. After patching, test authentication, registration, payments, file uploads, contact forms, dashboards and integrations. Review available monitoring and logs for suspicious behavior, and seek incident-response expertise if there are indicators of compromise.

Tell users what is happening

If downtime is necessary, publish a calm and accurate maintenance notice through a trusted channel. Explain which services are unavailable, where to find updates and how urgent users can contact the organization. Do not declare that data is safe or compromised without supporting evidence. Clear communication is part of operational trust.

8. What this crisis teaches businesses about digital quality

A website is not a one-time design deliverable that can be left untouched indefinitely. It is a living product with dependencies, infrastructure, users and ongoing maintenance obligations. A beautiful interface cannot protect an unpatched server; equally, a technically secure product can still fail its audience through confusing communication and poor experience.

Modern brands need three complementary habits: maintain the underlying technology, design clear and accessible user journeys, and plan how to communicate during incidents. Together they help build credibility when circumstances are uncertain.

At Blan Studio, our subscription-based design approach helps startups and modern businesses develop cohesive branding, refined interfaces and evolving digital experiences. If you are improving your website or preparing a new digital product, explore our creative services at wablan.com. Security assessments, server patching and incident response should remain with qualified technical specialists; strong design works alongside that expertise.

9. FAQ: Why are government websites down?

Why are government websites down today?

Several government services were temporarily disabled in response to critical PHP vulnerabilities disclosed on October 20–21, 2026. Other sites may have unrelated outages. Check the responsible institution for live status.

Is there a worldwide government internet outage?

There is an international pattern of PHP-related preventive shutdowns, not evidence that every government site or the whole internet failed simultaneously.

Why are French prefecture websites under maintenance?

France’s Interior Ministry confirmed a temporary precautionary shutdown while awaiting a security fix for the PHP framework used by those sites.

Why was Overheid.nl unavailable?

The Dutch government information portal was among services reported to have been taken offline as a precaution during the PHP response. Its current status must be checked with the operator.

Why is marchespublics.gov.ma not working?

We have not verified an official statement confirming that a specific outage of Morocco’s public procurement portal was caused by PHP2Shell. The responsible authority should confirm its status and cause.

Are Moroccan government websites affected?

Moroccan reporting says the DGSSI issued a critical PHP alert. That does not independently establish the cause of downtime on any individual Moroccan portal.

Have government websites been hacked?

Some shutdowns were explicitly preventive, with no confirmed breach. A vulnerability, an attempted attack and a successful compromise are different events.

What are PHP2Shell and CVE-2026-109618 / CVE-2026-109619?

PHP2Shell is a name used in coverage of the October 2026 incident. The CVE numbers identify two separate critical PHP flaws capable of unauthenticated remote code execution in affected conditions.

Does PHP2Shell affect WordPress?

WordPress runs on PHP. A site using an affected PHP runtime may be exposed even if WordPress core and plugins are current. Verify and patch the underlying runtime.

Does 75.4% PHP usage mean 75.4% of Moroccan websites were hacked?

No. That is a technology-adoption statistic for identifiable server-side languages on a sample of .ma websites, not a compromise or vulnerability rate.

Is the PHP vulnerability fixed?

The PHP project released fixes on October 21. Individual sites still need to install and verify the appropriate vendor or upstream security update.

When will government websites return?

There is no universal restoration time. Each organization must complete its own patching, testing and authorization to reopen.

Should I change my password?

Preventive maintenance alone does not prove your data leaked. Follow service-specific official guidance, use unique passwords and enable multifactor authentication where available.

Did AI discover the flaws?

OpenAI says Calif used GPT-5.6 Sol to identify a critical flaw, while Wiz independently identified and reported both vulnerabilities.

Where can I find verified updates?

Use the PHP project and CERT-EU for technical information, the Moroccan DGSSI for national alerts, and each institution for the current status of its own website.

Sources and verification

• PHP Project: official security releases and advisory
• CERT-EU: Security Advisory 2026-018
• Reuters: websites taken offline over PHP risks, October 21
• Médias24: PHP vulnerabilities and Morocco’s DGSSI alert
• OpenAI: Patch the Planet coordinated disclosure

Editorial note: Sources were checked against information available through October 22, 2026. Reported downtime does not prove a successful attack or establish the cause of every unavailable service.