Government, hospital and university websites across Europe went offline on Wednesday because of two critical flaws in PHP, the programming language behind a large share of the web.
Operators took the sites down themselves. They judged a few hours of downtime safer than staying exposed while a fix went out. The shutdowns followed a warning about the two flaws.
The choice is the interesting part. Pulling a site is the blunt option, and public institutions usually avoid it because citizens, patients and students lose access to services. That so many operators chose it at once suggests they rated the risk of leaving the flaws open above the cost of an outage.
PHP explains why the reaction was so synchronized. Unrelated organizations, with different budgets and different IT teams, often run on the same underlying language. A critical flaw in it lands on all of them at the same moment, and they all face the same decision on the same day.
The closest recent comparison is Log4Shell, the December 2021 flaw in a widely used Java logging library that sent organizations worldwide into emergency patching. The pattern is the same: shared software turns many separate institutions into one large target, and the defense often comes down to how quickly each operator can act.