A website going dark is usually a small modern tragedy. You cannot pay a bill, book an appointment, check an update or, in the most dramatic cases, discover whether the new episode of a beloved TV show has aired. But when public bodies and organisations take sites offline deliberately, the inconvenience may be the least alarming part of the story.
A BBC News report described a wave of precautionary website shutdowns following the discovery of two critical flaws in PHP, the long-established programming language used across a vast share of the web. The report said websites linked to Edinburgh Council, the BBC’s Doctor Who pages, and organisations in Japan, Belgium and the Netherlands were among those affected. It also said some cyber-security authorities temporarily took down their own sites while warning others of the risk.
Those individual cases and the full technical scope should be treated with care until confirmed by the affected organisations and relevant security agencies. Yet the incident, as reported, captures a very real European security problem: a vulnerability can move from obscure technical discovery to operational crisis with frightening speed—especially when AI tools accelerate both detection and attempted exploitation.
Why a flaw in PHP can become everybody’s problem
PHP is not glamorous. It is the plumbing behind a large number of websites, content-management systems and online services. That is precisely what makes it consequential. A serious weakness in a widely deployed component does not remain a problem for one software supplier; it can ripple through councils, retailers, charities, media outlets, booking platforms and small businesses whose web infrastructure may have been assembled in several different eras of the internet.
The BBC report said researchers used advanced AI systems to identify two critical weaknesses and uncover a complex chain of actions that would be difficult for human researchers to find alone. In plain English: the concern was not merely a bug, but the possibility that combining several precise conditions could allow an attacker to compromise a vulnerable website.
That distinction matters. Security teams are accustomed to patches. They are less comfortable with a flaw whose practical path to abuse may be difficult to spot at first, but easier to reconstruct once the existence of the vulnerability becomes public. In cyber security, obscurity is a flimsy umbrella in a hurricane.
AI is a force multiplier, not a villain in a hoodie
The central lesson is not that AI has suddenly become evil. The reported discovery was, initially, an example of defensive research: using powerful tools to find weaknesses before attackers can exploit them. That is useful work, and Europe needs much more of it.
The problem is the symmetry. Techniques that help researchers inspect enormous amounts of code, connect unusual conditions and prioritise suspicious patterns can also help criminals sift public technical information, tailor phishing messages, automate reconnaissance and test potential attack routes at scale.
The BBC report suggested attackers were trying to use AI to reverse-engineer an exploitation method against organisations that had not yet applied the available fix. Whether or not every reported outage traces to the same risk, the broad pattern is familiar: disclosure starts a countdown clock. Defenders must identify affected systems, test a patch, deploy it safely and monitor for abuse. Attackers need only find one organisation that is late.
AI shortens that clock. It does not eliminate the need for a human to make decisions, but it can reduce the time and expertise needed to search for weak targets. For under-resourced organisations, particularly smaller councils, suppliers and local firms, that is an uncomfortable equation.
Taking a site offline can be responsible, not embarrassing
When a public-facing service disappears, frustration arrives quickly. So do accusations of incompetence. Sometimes they are justified; sometimes the outage is the security equivalent of closing a building after discovering a gas leak. Nobody enjoys it, but leaving the doors open would be worse.
A temporary shutdown can give teams time to isolate systems, apply vendor fixes, check logs for suspicious activity and prevent a vulnerable application from becoming an entry point into something more sensitive. It is not a magic shield—an attacker may already have gained access, and offline services still need careful investigation—but it can be a rational containment measure.
The crucial issue is communication. Public services and businesses should say what customers need to know: which service is unavailable, what alternative route exists, whether personal data is believed to be affected, and when the next update will be published. Saying nothing creates an information vacuum, and the internet fills vacuums with rumours at the speed of a dropped biscuit at a crowded café.
Europe’s rules are pushing cyber resilience from IT cupboard to boardroom
European regulation is increasingly designed around the idea that cyber security is operational resilience, not a niche concern for the people who know where the server room is.
The EU’s NIS2 Directive raises cyber-risk management and incident-reporting expectations for a wide range of essential and important entities, including sectors such as energy, transport, health, digital infrastructure and public administration. Its national implementation and scope vary across member states, but its direction is unambiguous: leadership must take cyber risk seriously, assess supply-chain exposure and have credible incident-handling arrangements.
The Digital Operational Resilience Act (DORA), applicable to much of the EU financial sector from January 2025, similarly focuses on ICT risk management, testing and third-party technology dependencies. Meanwhile, the Cyber Resilience Act establishes cybersecurity requirements for products with digital elements, with obligations phased in over time. These rules cannot patch a web server at 2am, sadly, but they aim to make the organisation behind that server better prepared before the alarm sounds.
For European organisations, the practical message is clear: know what software runs your essential services, who maintains it, how quickly it can be updated, and what happens when it cannot.
What organisations should do when the next critical alert lands
There is no silver bullet, only disciplined habits. The first is asset visibility. A company cannot patch systems it has forgotten exist, and forgotten systems have a talent for surviving long enough to become everyone’s worst Tuesday.
- Maintain an accurate inventory of internet-facing applications, servers, frameworks, plug-ins and third-party services.
- Subscribe to trusted vendor and national cyber-security alerts, then assess exposure quickly rather than assuming an update can wait for the next maintenance window.
- Test and deploy critical patches through an emergency process, with documented authority to act outside routine change schedules when the risk warrants it.
- Reduce exposure where patching is delayed: restrict access, disable non-essential features, add web application firewall rules and monitor closely. These are compensating controls, not permanent substitutes for fixing the problem.
- Keep tested backups and an incident plan that covers technical containment, legal reporting, customer communications and executive decision-making.
- Ask suppliers hard questions about vulnerability management, notification times and the software components embedded in their services.
Consumers are not powerless either
For the public, a temporarily unavailable council portal or retailer is mostly an irritation. But cyber incidents can also become opportunities for fraudsters. A real outage makes fake “service restored” emails, bogus compensation offers and password-reset requests look more convincing.
Use official bookmarks or independently verified contact channels rather than links in unexpected messages. Be wary of urgency, especially messages demanding immediate payment or credentials. Turn on multi-factor authentication where available, and use unique passwords stored in a reputable password manager. None of this makes a vulnerable website secure, but it makes stealing your account considerably less convenient.
The reported PHP episode is a warning about a new rhythm in cyber security. AI can help reveal dangerous weaknesses earlier, which is the good news. The bad news is that everyone else may hear about them earlier too. Europe’s resilience will depend less on futuristic slogans than on the unfashionable basics: asset lists, patches, backups, rehearsed decisions and honest communication when a service has to go dark.