A cascade of website shutdowns is rippling across the internet as administrators respond to newly disclosed critical vulnerabilities in PHP, the programming language that underpins an estimated 70% of websites worldwide.

Cybersecurity agencies in Europe, Australia, Japan, and the United Kingdom have issued advisories urging organizations to either patch immediately or take PHP-based websites offline entirely. The warnings come as posts circulating on Bluesky describe the vulnerabilities as "trivially exploitable" remote code execution flaws affecting PHP versions 5.0 and later.

Precautionary Shutdowns Spread

The scale of the response is evident in the range of organizations taking preemptive action. Posts on Bluesky report that Amsterdam's Schiphol Airport—Europe's second-largest by passenger volume—took its mobile app offline, though its website continued displaying flight information as of Wednesday afternoon. The airport's response illustrates how even critical infrastructure operators are prioritizing security over service continuity.

B3ta, a popular internet community site, announced its shutdown in a widely shared post: "We've taken the B3ta site down as there's a PHP insecurity turned up and it's likely affecting about half the internet. The responsible thing to do is take all your PHP sites offline until the hole is patched as bad actors with AI will be scanning websites for this hole to inject."

Knowledge Commons, an academic platform, similarly announced it was taking its main site temporarily offline "out of an abundance of caution," while keeping related services operational. WhatsOnReading, a community events site, posted that it had taken "the pre-emptive measure to take WhatsOnReading offline until our web engineers are able to update and protect the site."

The Technical Threat

According to posts referencing CERT-EU advisories, the vulnerabilities enable remote control of servers, allowing malicious actors to gain complete control. One post from a hobbyist developer noted that CERT-EU was "recommending admins take PHP servers offline if they cannot be patched. For hobbyist/personal websites I'd take them offline now."

The urgency stems partly from the nature of modern threat actors. Multiple posts reference concerns about "bad actors with AI" rapidly scanning websites to exploit the vulnerability before patches can be applied. This represents a shift in the threat landscape—automated tools can now identify and exploit vulnerabilities at scale within hours of public disclosure.

Official Warnings and Patch Timeline

Reuters reported that a cyber agency had warned "websites may go dark as PHP prepares critical fix," according to posts sharing the news outlet's coverage. EU cybersecurity officials have taken the unusual step of recommending that organizations unable to immediately apply fixes should "isolate their internet-facing apps from public networks or take them offline entirely until the vulnerabilities can be fully mitigated," according to posts quoting advisory language.

PHP developers announced Wednesday they would release patches for the two critical vulnerabilities, though the exact timeline remains unclear from the posts circulating on Bluesky. The gap between vulnerability disclosure and patch availability has created the current crisis, forcing administrators to choose between maintaining service and accepting significant security risk.

Why PHP Matters

PHP's ubiquity makes this vulnerability particularly consequential. Originally created in 1995, PHP has become the backbone of content management systems like WordPress, which alone powers more than 40% of all websites. The language's ease of use and extensive ecosystem have made it a default choice for web development across decades.

Posts note that "approximately 70 percent of websites run on PHP or use PHP-based applications," making this one of the most broadly impactful web security incidents in recent memory. The scope means that even organizations with robust security practices must take action, as the vulnerability exists in the core language rather than in individual applications.

The Broader Context

This incident highlights the fragility of internet infrastructure, where a single vulnerability in widely adopted technology can force simultaneous defensive action across millions of sites. The precautionary approach many administrators are taking—shutting down rather than risking exploitation—suggests lessons learned from previous incidents where delayed responses led to widespread breaches.

The conversation on Bluesky reveals a community of web administrators sharing information rapidly, with posts linking to cybersecurity advisories from multiple national agencies and news coverage from outlets including Channel News Asia, Cybersecurity Dive, and NL Times. This distributed information-sharing represents both the strength and challenge of modern security response—while warnings spread quickly, so does the knowledge that attackers can exploit.

For now, users may find familiar websites displaying maintenance messages or error pages. The disruption, while inconvenient, reflects administrators choosing caution over continuity—a calculation that the severity of these PHP vulnerabilities appears to justify.