Patch day: NSA says patch or go dark — Europe's government sites already did

The disclosure became a full patch-day emergency on Wednesday: PHP's developers rushed out emergency fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) at around 10 a.m. ET after details of the PHP2Shell flaws leaked online a day early, so attackers learned about them at the same time as defenders. Cloudflare reported signs of early exploitation before the public patch release and deployed stopgap firewall rules.

The NSA took the unusual step of telling organizations using PHP to update immediately — or take systems offline if they could not. Much of Europe did exactly that: government websites in Finland and the Netherlands went offline as a precaution, including the Dutch DigiD login system and the Dutch National Cyber Security Centre's own site, along with parts of Wikipedia, the forums 4chan and Something Awful, and the bookmarking service Pinboard. In Japan, services including the game Shadowverse: Worlds Beyond went into emergency maintenance.

CNN adds the twist this edition already leads with: researchers at OpenAI, Google's Wiz, and Calif all used AI to find and fix the flaws — Gemini 4 Argon and GPT-5.6 Sol did the work — while Washington now worries the same tools will supercharge cyberattacks.