European Government Websites Temporarily Offline Due to PHP Vulnerability

Source reports published 21 Oct 2026, 11:28 pm – 22 Oct 2026, 9:15 pm AEST

Following the issuance of a critical software update, numerous government and business websites across Europe, including those of the UK, Finland, France, Denmark, and several councils, experienced temporary downtime. This action was taken as a precaution to address a vulnerability in the PHP programming language.

What happened

• In response to a ‘critical security issue’ discovered in PHP, a popular programming language used by approximately 70 per cent of websites, several government and business websites across Europe were taken offline.
• The Office for Budget Responsibility (OBR) took down its website ahead of next week’s Budget, while Oxford City Council and the City of Edinburgh Council also experienced downtime.
• According to a spokesperson for the OBR, the action followed guidance to address the critical security issues affecting PHP.
• Cybersecurity chiefs instructed British organisations to update to a new, fixed version of PHP or take their websites offline.
• The National Cyber Security Centre (NCSC) collaborated with OpenAI and international partners to resolve the issue.
• No large public-facing critical services were affected, but some limited services were temporarily offline during security work.
• A minister stated that the security of next week’s Budget was not compromised.
• The incident affected websites for hospital resources and school websites alongside Government portals.
• The vulnerability was identified by cybersecurity firm Cloudflare.

Original reporting

• Sky News: Websites across Europe taken down - as critical software update issued
  2026-10-21T13:28:00+00:00
• GB News: UK Government websites taken offline amid cyber security threat
  2026-10-22T11:15:27+00:00