A security vulnerability in PHP, the programming language used to build websites, has raised the risk that external attackers could remotely take control of servers. Governments in several countries temporarily suspended some web services to apply patches and conduct inspections, while cryptocurrency companies checked whether they were exposed.

Cointelegraph reported on October 22 that the PHP Foundation disclosed why its response was delayed even after distributing an emergency patch. The foundation said patching work was repeatedly halted for months because of the security team's decision-making process and limited resources. It described the delay as a structural failure.

The vulnerability involved two flaws that could allow unauthenticated attackers to execute arbitrary code on servers. The foundation said it detected related signs in 2024, but a fix was delayed as it considered the impact on the existing PHP ecosystem. The response became a higher priority in August after security firm Calypso and OpenAI separately reported the vulnerabilities and demonstrated that real attacks were possible.

The government service suspensions were carried out as a precaution, not because attacks had been confirmed. The Netherlands' digital identity service and National Cyber Security Centre website, as well as Finland's public government web services, were temporarily taken offline. France and Germany also suspended some government websites.

In the cryptocurrency industry, Coinbase and BitGo disclosed the results of their reviews. Coinbase Chief Security Officer Jeff Lunglhofer said the company conducted a full inspection as soon as it learned of the flaw and found no exposed PHP instances. BitGo also said its platform was unaffected.

Binance co-founder Changpeng Zhao said some websites may still not have applied the patch and urged users to be cautious when visiting websites over the next few days. The PHP security team said no real-world exploitation had been confirmed by the time of disclosure.