Back to the trend of the day: Two PHP flaws let strangers seize websites; some went offline for safety
Poly Rating · from the trend of the day

PHP Flaw: Government Websites Offline by Country, Oct 2026

Finland and the UK both score a perfect 100 on cyber readiness, yet both still pulled public sites offline, and 24 hours after the fix 99.3% of measurable PHP hosts worldwide were still unpatched.

  • No. 1: Netherlands
  • 10 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    Netherlands

    No host count published, so it is placed by response. Unreachable .nl sites rose 3.4× in a day, the biggest jump. Parliament and NCSC went dark; reports conflict on DigiD.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 6 · ChatGPT: 1 · Grok: 3 · Nemotron: 3 · Gemini: 1 · Kimi: 2 · Wenxin: 1

    What each AI noted 7
    • Claudeplace 6

      .nl outages jumped 3.4× in a day, the biggest rise, yet the government reported no sign of abuse.

      Source ↗
    • ChatGPTplace 1

      The Dutch government took services including Overheid.nl, MijnOverheid.nl, and DigiD offline as a precaution before the fix was available.

      Source ↗
    • Grokplace 3

      Took multiple government portals including DigiD and MijnOverheid offline as a precaution hours before the patches landed

      Source ↗
    • Nemotronplace 3

      ~180K vulnerable hosts; took some .gov services offline preemptively; 60% drop in 5 days — preparation or patch lag?

      Source ↗
    • Geminiplace 1

      Proactively took vital national portals including DigiD and the NCSC website offline within 24 hours of flaw disclosure rather than risking live exploitation.

    • Kimiplace 2

      The country that advised the world to isolate unpatched systems then did it to itself — parliament, the public-health institute and its own cyber agency's site all went dark.

      Source ↗
    • Wenxinplace 1

      Took several public services offline as a precaution — the fastest measured drop in exposed PHP hosts after the fix, but that meant business as usual stopped for days

    7 AIs put it here
    Source ↗
  2. 2

    Germany

    Fourth by host count. Unreachable .de sites more than doubled in a day (8,660 to 18,422) as federal sites and hosts like Netcup went offline to patch.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 4 · ChatGPT: 6 · Grok: 5 · Nemotron: 2 · Gemini: 3 · Kimi: 5 · Wenxin: 3

    What each AI noted 7
    • Claudeplace 4

      Fourth by host count. Its .de outages doubled in a day while the digital ministry called the federal shutdowns 'purely preventive'.

      Source ↗
    • ChatGPTplace 6

      German websites were among those reported offline, but the public record reviewed does not provide a comparable national vulnerable-host count.

      Source ↗
    • Grokplace 5

      Appears among the top absolute counts after the US, China and Japan, with federal IT providers also taking some services offline

      Source ↗
    • Nemotronplace 2

      ~380K vulnerable hosts; BSI coordinated patch push; 68% drop in 72h; strong hosting provider compliance

    • Geminiplace 3

      Leveraged strict BSI federal incident coordination across Frankfurt hosting clusters to drive down exposed enterprise endpoints by 38% in three days.

    • Kimiplace 5

      German providers chose the hard shutdown: Netcup pulled every shared server offline to patch, and Uberspace simply switched PHP off at 15:45 CEST.

      Source ↗
    • Wenxinplace 3

      BSI warned hosting providers on Oct 21; by Oct 23 the exposed count had halved, but 61 % of German sites still use PHP 8.0 or below

    7 AIs put it here
    Source ↗
  3. 3

    France

    25,439 hosts with no fix (54%), seventh by that count, but first by far in PHP services (6.62M, mostly Freebox routers). Prefecture sites went offline.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 3 · ChatGPT: 4 · Grok: 8 · Nemotron: 4 · Gemini: 4 · Kimi: 7 · Wenxin: 5

    What each AI noted 7
    • Claudeplace 3

      54% of its versioned hosts have no fix, and prefecture sites were still on maintenance pages the evening of 21 October.

      Source ↗
    • ChatGPTplace 4

      France's response included temporary restrictions on local-government administrative websites and PHP-based services at Orange.

      Source ↗
    • Grokplace 8

      25,439 hosts on no-official-fix branches (54% of its versioned PHP hosts); some government sites also went offline

      Source ↗
    • Nemotronplace 4

      ~320K vulnerable hosts; ANSSI alert J+1; 55% drop in 6 days; public sector patch mandate 30 days

    • Geminiplace 4

      ANSSI national alerts mobilized European hosting providers like OVHcloud, achieving a 34% reduction in unpatched PHP servers within 72 hours.

    • Kimiplace 7

      OVHcloud drew the era's cleanest line: every shared customer patched automatically — VPS customers, you're on your own.

      Source ↗
    • Wenxinplace 5

      ANSSI moved fast on paper but France's exposed PHP count barely budged in 48 hours — a gap between readiness score and actual patching speed

    7 AIs put it here
    Source ↗
  4. 4

    United States

    228,770 hosts with no official PHP fix, the most of any country. That comes from one Shodan count; counting PHP services instead puts France first.

    Included it: Claude, Grok, Nemotron, Gemini, Kimi, Wenxin. Did not include: ChatGPT.

    In their lists: Claude: 1 · Grok: 1 · Nemotron: 1 · Gemini: 2 · Kimi: 1 · Wenxin: 2

    What each AI noted 6
    • Claudeplace 1

      228,770 hosts with no official PHP fix, the most of any country. The NSA's advice was to go offline if you could not update immediately.

      Source ↗
    • Grokplace 1

      Largest absolute count of hosts on branches that receive no official PHP fix (228,770) despite a near-perfect GCI score

      Source ↗
    • Nemotronplace 1

      Highest absolute vulnerable hosts (~1.2M), but 72% drop in 48h post-patch; .gov BOD 22-01 forces 14-day patch

      Source ↗
    • Geminiplace 2

      Hosts the largest global pool of exposed PHP servers with over 320,000 instances, countered by rapid cloud automation that slashed exposure by 45% within 48 hours.

      Source ↗
    • Kimiplace 1

      The biggest PHP footprint on Earth closed its gap the messy way — GoDaddy told customers to patch themselves, the volunteer Remi repo had nothing on day one, and the University of Washington simply null-routed its own machines.

    • Wenxinplace 2

      Largest absolute number of vulnerable hosts — over 380 000 on Oct 21 — yet CISA mandated patching in 14 days, and the drop was steady but not dramatic

      Source ↗
    6 AIs put it here
    Source ↗
  5. 5

    Japan

    Third by host count. The Prime Minister urged checks, banks and airlines suspended services. Sources disagree on whether government sites went down; Nippon.com says the finance ministry and tax agency did.

    Included it: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi. Did not include: Wenxin.

    In their lists: Claude: 5 · ChatGPT: 3 · Grok: 6 · Nemotron: 8 · Gemini: 6 · Kimi: 6

    What each AI noted 6
    • Claudeplace 5

      Third by host count. Its outages reached games, shops, banks and airlines rather than government sites.

      Source ↗
    • ChatGPTplace 3

      Japan's Ministry of Finance, National Tax Agency, and major financial and transport companies suspended some online services while other key services remained available.

      Source ↗
    • Grokplace 6

      High absolute exposure among the countries listed for hosts that will not receive an official PHP release

      Source ↗
    • Nemotronplace 8

      ~210K vulnerable hosts; JPCERT/CC alert J+1; 50% drop in 6 days; legacy enterprise PHP 7.4 common

      Source ↗
    • Geminiplace 6

      JPCERT/CC coordinated with major telecom and cloud providers, closing 30% of critical exposures across .jp infrastructure inside 72 hours.

      Source ↗
    • Kimiplace 6

      The Prime Minister went on social media to ask citizens to check whether publicly available websites run PHP — national mobilisation by tweet.

      Source ↗
    6 AIs put it here
    Source ↗
  6. 6

    United Kingdom

    No host count, so it is placed by response. The NCSC told unpatched operators to go offline, and Edinburgh council, BBC pages and the OBR then went dark despite a GCI score of 100.

    Included it: ChatGPT, Nemotron, Gemini, Kimi, Wenxin. Did not include: Claude, Grok.

    In their lists: ChatGPT: 5 · Nemotron: 5 · Gemini: 5 · Kimi: 4 · Wenxin: 4

    What each AI noted 5
    • ChatGPTplace 5

      The UK NCSC advised operators to patch immediately or consider taking a system offline; reporting identified disruptions affecting public services.

      Source ↗
    • Nemotronplace 5

      ~290K vulnerable hosts; NCSC advisory J+0; 58% drop in 4 days; public sector patch 14 days

    • Geminiplace 5

      The NCSC Active Cyber Defence automated warning system directed hosting operators to patch, lowering vulnerable public IPs by 41% in 4 days.

    • Kimiplace 4

      The NCSC told the world to take systems offline if unpatched — and Britain's own council sites and BBC pages promptly did.

      Source ↗
    • Wenxinplace 4

      NCSC issued an alert within hours of the PHP fix but took no services offline; exposed host count fell 31 % in 48 h — moderate speed for a top-ranked GCI country

    5 AIs put it here
    Source ↗
  7. 7

    Finland

    No host count, so it is placed by response. Despite a perfect GCI score of 100, the state IT centre Valtori took government public web services offline and patched overnight.

    Included it: Claude, ChatGPT, Grok, Kimi. Did not include: Nemotron, Gemini, Wenxin.

    In their lists: Claude: 9 · ChatGPT: 2 · Grok: 4 · Kimi: 3

    What each AI noted 4
    • Claudeplace 9

      Valtori, the state IT centre, pulled government public web services offline before the patch was out.

    • ChatGPTplace 2

      Finland's state IT services provider said government public-network services were taken offline and patches installed overnight.

      Source ↗
    • Grokplace 4

      State IT centre Valtori shut public-facing central government services offline as a pure precaution, not after a breach

      Source ↗
    • Kimiplace 3

      The only country with a perfect 100 on the ITU cyber index chose to switch off its entire government web presence rather than patch in place.

      Source ↗
    4 AIs put it here
    Source ↗
  8. 8

    China

    Second by host count, and 75% of its versioned PHP hosts have no official fix. That is one Shodan count, and no source gives its speed of closure.

    Included it: Claude, Grok, Gemini. Did not include: ChatGPT, Nemotron, Kimi, Wenxin.

    In their lists: Claude: 2 · Grok: 2 · Gemini: 8

    What each AI noted 3
    • Claudeplace 2

      Second by host count, and 75% of its versioned PHP hosts have no official fix.

      Source ↗
    • Grokplace 2

      Second-largest absolute exposure and one of the highest shares (75%) of versioned hosts on unfixable branches

      Source ↗
    • Geminiplace 8

      Houses over 180,000 unpatched PHP web hosts, where vast regional ISP autonomy resulted in a slower 16% remediation reduction over the first 5 days.

    3 AIs put it here
    Source ↗
  9. 9

    South Korea

    82% of its versioned PHP hosts have no official fix, among the highest shares in the Shodan top ten, despite a GCI score of 100.

    Included it: Claude, Grok. Did not include: ChatGPT, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 7 · Grok: 7

    What each AI noted 2
    • Claudeplace 7

      82% of its versioned PHP hosts have no official fix, the second-highest share among the top ten.

      Source ↗
    • Grokplace 7

      82% of its versioned PHP hosts sit on branches without an official fix, among the highest percentages reported

      Source ↗
    2 AIs put it here
    Source ↗
  10. 10

    Algeria

    100% of its charted PHP hosts lack a fix, almost all on PHP 5.3 on one telecom network (Telecom Algeria).

    Included it: Claude, Grok. Did not include: ChatGPT, Nemotron, Gemini, Kimi, Wenxin.

    In their lists: Claude: 8 · Grok: 9

    What each AI noted 2
    • Claudeplace 8

      100% of the PHP hosts in the Shodan top-ten chart lack a fix, mostly PHP 5.3 on one telecom network.

      Source ↗
    • Grokplace 9

      100% of its versioned PHP hosts (almost entirely PHP 5.3 on Telecom Algeria) have no official fix path

      Source ↗
    2 AIs put it here
    Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The three are not measured the same way: the Netherlands is placed by its jump in unreachable sites (no host count), Germany by its outages, and France by hosts with no official fix.

1Netherlands

No. 1 — Netherlands. On the lists of 7 of 7 AIs; median place there: 2. The AIs put it first because it pulled key government sites offline on purpose, and its unreachable sites rose the most in one day.

Did you know

  • About a quarter of the Netherlands lies below sea level, and only about half of the land is more than one metre above it. Much of the country is kept dry by dikes, pumps and polders.

    Source ↗ ✓ confirmed by several AIs
What it is
A country that switched off government sites as a precaution before the PHP fixes.
Its edge
Its one-day jump in unreachable sites was bigger than Germany's or France's.
Who should know
Useful for anyone wondering why a site being offline does not mean it was hacked.
  • Offline sites and unfixed hosts3.4× more unreachable .nl sites
  • Founded1795
  • HeadquartersKingdom of the Netherlands
  • Population17.9 million (2024)

Wikipedia · Wikidata

Why it is here

  • UptimeRobot counted 4,356 unreachable .nl sites on Oct 20 and 14,682 on Oct 21, about 3.4 times more. That is the biggest one-day jump of the three countries, which is why the Netherlands comes first.

    Source ↗

  • Germany's jump was 2.1 times and France's 2.4 times, so the Dutch rise was larger than both. The sites switched off included the national cyber centre, DigiD, MijnOverheid, the House of Representatives and the Port of Rotterdam.

    Source ↗
History

  • On 10 February 2015, attackers flooded most of the Dutch central government's main public websites with traffic. The sites stayed down for over seven hours, while phone and emergency lines kept working.

    Source ↗
Keep in mind

  • DigiD, used for many government and health services, went offline as a precaution. Offline does not mean hacked. The NCSC has confirmed no active abuse so far. Users should wait and retry, and be wary of messages offering 'alternative' logins.

    Source ↗

  • The article gives no date for when the offline sites, including parliament's, will return. It says PHP's fixes were set for 4 p.m. Wednesday, and that time could move earlier.

    Source ↗
Where to go further

  • Read the Dutch part first. DigiD, the Overheid.nl portal and the parliament website went dark as a precaution while PHP patches were installed. The article says this does not mean they were hacked.

    Source ↗

Video: Netherlands in 100 Seconds | National Geographic · National Geographic

Compare the top three ↓

2Germany

No. 2 — Germany. On the lists of 7 of 7 AIs; median place there: 4. The AIs ranked it second because its unreachable sites more than doubled in a day as federal sites and hosts went offline to patch.

Did you know

  • Frankfurt's DE-CIX is a hub where networks swap internet traffic. On 20 November 2024 at 8:11 PM it carried 18.11 terabits per second, a record, and close to 1,100 networks were connected.

    Source ↗
What it is
A country where federal sites and big hosting firms went offline to patch.
Its edge
It had the most unreachable sites of the three on Oct 21.
Who should know
Useful for anyone who runs a site, since small sites may stay exposed longer.
  • Offline sites and unfixed hosts8,660 to 18,422 unreachable
  • Founded0641
  • HeadquartersGermany
  • Population83.5 million (2025)

Wikipedia · Wikidata

Why it is here

  • Unreachable .de sites rose from 8,660 on Oct 20 to 18,422 on Oct 21, a 2.1 times increase. That is the largest absolute count of the three countries on Oct 21, though the rise is smaller than the Dutch one.

    Source ↗

  • Germany's digital ministry called taking several federal websites offline 'purely preventive'. Public-sector sites were part of the jump, but the rise stayed at 2.1 times, below the Netherlands (3.4) and France (2.4).

    Source ↗
History

  • In 2011 Germany's federal finance agency, Deutsche Finanzagentur, took its website offline after white-hat hackers from the Chaos Computer Club reported a serious security flaw. The flaw could have enabled spying, credential theft and phishing.

    Source ↗
Keep in mind

  • Germany's federal IT service ITZBund took down several portals. Euronews says taking sites offline does not mean they were hacked. The PHP Foundation's security team found no working exploit in the leaked proof-of-concept code. Cloudflare said it saw attack traffic.

    Source ↗

  • The flaw's IDs leaked online before the fix was ready, so PHP released a day early. Large institutions can patch fast, but small sites and blogs may stay exposed for weeks or months.

    Source ↗
What people say

  • "There are sites, systems and people out there who will have no idea about this." — Steve Kerrison, James Cook University (Singapore), in Euronews

    Source ↗
Where to go further

  • Open the German article (in German) and look at the list of seven states. Bavaria's police were back by the evening of 21 October. Berlin was only partly back, and Brandenburg's police web office was still offline when it was written.

    Source ↗

Video: Ten Minute History - The Weimar Republic and Nazi Germany (Short Documentary) · History Matters

Compare the top three ↓

3France

No. 3 — France. On the lists of 7 of 7 AIs; median place there: 4. The AIs placed it third because more than half its versioned PHP hosts have no fix, though its outages were smaller than the other two.

Paris from the Arc de Triomphe, 17 October 2019
Pierre Blaché from Paris, France · CC0 · Wikimedia Commons

Did you know

  • France is the world's most visited country. Time Out, citing UN Tourism, says it had about 100 million visitors in 2024, a new record. Spain came second with 94 million. Many of the 2024 visitors probably came for the Paris Olympics.

    Source ↗
What it is
A country with many PHP hosts that can't be fixed, many of them home routers.
Its edge
It has the most PHP services, and over half its versioned hosts have no fix.
Who should know
Useful for anyone with older devices that no longer get security updates.
  • Offline sites and unfixed hosts25,439 hosts, 54% no fix
  • Founded0481
  • HeadquartersFrance
  • Population68.6 million (2025)

Wikipedia · Wikidata

Why it is here

  • Unreachable .fr sites rose from 3,158 on Oct 20 to 7,492 on Oct 21, about 2.4 times. That is a bigger jump than Germany's 2.1 times, but a smaller one than the Netherlands' 3.4 times.

    Source ↗

  • France had the smallest absolute count of unreachable sites of the three: 7,492 on Oct 21, against 14,682 in the Netherlands and 18,422 in Germany. Prefecture websites were taken down as a precaution until the patch was applied.

    Source ↗
History

  • In 1940, after France’s defeat, Charles de Gaulle’s Appeal of 18 June became the starting point of Free France, which sought to rally people who refused defeat and wanted to resist German occupation. — (voice only)

    Source ↗
Keep in mind

  • Danfoss said many of the hit units were older models, or newer ones on old firmware. The AK-SM800 and AK-SC355 no longer get security updates, so some exposed French devices cannot be patched.

    Source ↗

Video: Who are France’s rioters and what do they want? | BBC News · BBC News

Compare the top three ↓

The top three side by side

NetherlandsGermanyFrance
In the AIs' lists7 / 77 / 77 / 7
Offline sites and unfixed hosts3.4× more unreachable .nl sites8,660 to 18,422 unreachable25,439 hosts, 54% no fix
Founded179506410481
HeadquartersKingdom of the NetherlandsGermanyFrance
Population17.9 million (2024)83.5 million (2025)68.6 million (2025)
Put first byChatGPT, Gemini, Wenxin——

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

Europe felt it most: alerts from European monitors rose about 20× (about 1,100 to 23,000 per minute), against about 6× in North America.

Noticed by:
Included it: Claude. Did not include: ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.
Source ↗

No open per-country scan counts or patch-speed series existed on 22 Oct, so 'days to first large drop' cannot yet be measured for any country.

Noticed by:
Included it: Claude, ChatGPT, Kimi. Did not include: Grok, Nemotron, Gemini, Wenxin.
Source ↗

Hosting companies, not national agencies, set the closure speed: Hostinger finished its platform-wide fix by 06:44 UTC on 22 Oct, while GoDaddy left the check to its customers.

Noticed by:
Included it: Kimi. Did not include: Claude, ChatGPT, Grok, Nemotron, Gemini, Wenxin.
Source ↗

Exploitation status is contested: Amazon logged an attempt on 17 Oct and watchTowr saw attempts, but CISA had not listed either flaw in its KEV catalog and the Dutch NCSC saw no abuse.

Noticed by:
Included it: Claude, ChatGPT, Grok, Kimi. Did not include: Nemotron, Gemini, Wenxin.
Source ↗

Readiness scores did not predict the response: countries with perfect GCI scores chose to shut services down, and the index cannot tell strong preparation from an inability to patch quickly.

Noticed by:
Included it: ChatGPT, Grok, Kimi. Did not include: Claude, Nemotron, Gemini, Wenxin.
Source ↗

04How we counted

In plain words, no formulas.

1The question

Top 10 Countries by Exposure to the October 2026 PHP Flaws Compared With How Fast They Closed the Gap

2Why this topic

It checks national readiness scores against how fast each country actually closed the hole, and no single table makes that comparison.

3Where it applies

Global, by country; public and private web servers

4What we looked at

  • Vulnerable PHP servers found per million internet users, and in absolute numbers
  • Days from the fix's release to the first large drop in exposed servers
  • Share of exposed servers on government or public-sector networks
  • Speed compared with the country's own record on earlier critical flaws
  • National cyber readiness score compared with the speed it actually achieved
  • CybelAngel / Mallory (Shodan, 20–21 Oct) — Internet-facing hosts on PHP branches with no official fix, by country; ranks 1–7 come from this single count
  • Infrawatch (via CybelAngel) — Active PHP services rather than hosts; it puts France far ahead because of home routers
  • UptimeRobot country-domain monitor — Unreachable monitored sites by national domain, 20 vs 21 Oct (all sites, not only government)

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Claude, ChatGPT, Grok, Nemotron, Gemini, Kimi, Wenxin.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

05Each AI's own list

🇺🇸 Claude10 places · 4 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    United States

    228,770 hosts with no official PHP fix, the most of any country. The NSA's advice was to go offline if you could not update immediately.

    Source ↗
  2. 2
    China

    Second by host count, and 75% of its versioned PHP hosts have no official fix.

    Source ↗
  3. 3
    France

    54% of its versioned hosts have no fix, and prefecture sites were still on maintenance pages the evening of 21 October.

    Source ↗
  4. 4
    Germany

    Fourth by host count. Its .de outages doubled in a day while the digital ministry called the federal shutdowns 'purely preventive'.

    Source ↗
  5. 5
    Japan

    Third by host count. Its outages reached games, shops, banks and airlines rather than government sites.

    Source ↗
  6. 6
    Netherlands

    .nl outages jumped 3.4× in a day, the biggest rise, yet the government reported no sign of abuse.

    Source ↗
  7. 7
    South Korea

    82% of its versioned PHP hosts have no official fix, the second-highest share among the top ten.

    Source ↗
  8. 8
    Algeria

    100% of the PHP hosts in the Shodan top-ten chart lack a fix, mostly PHP 5.3 on one telecom network.

    Source ↗
  9. 9
    Finland

    Valtori, the state IT centre, pulled government public web services offline before the patch was out.

  10. 10
    Czech Republic

    A government website stayed dark until security updates were applied, with the timeline listing 17:00 UTC on 21 October.

    Source ↗

What Claude noticed

Europe felt it most. Alerts from European monitors rose about 20× (about 1,100 to 23,000 per minute), against about 6× in North America. Asia and Oceania barely changed.

Source ↗

Switzerland's .ch outages rose 2.9×, the second-largest jump, though no Swiss government shutdown is listed.

Source ↗

Governments gave different advice. CERT-EU, the UK NCSC and the US NSA suggested isolating or taking sites offline if they couldn't patch. Japan's cyber office urged immediate updates.

Source ↗

Some Dutch sites avoided the problem because they don't use PHP. Rijksoverheid.nl stayed up, and the supermarket Picnic's ordering systems don't run on PHP either.

Source ↗
🇺🇸 ChatGPT10 places · 3 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    Netherlands — PHP2Shell government-service shutdowns, 2026

    The Dutch government took services including Overheid.nl, MijnOverheid.nl, and DigiD offline as a precaution before the fix was available.

    Source ↗
  2. 2
    Finland — PHP2Shell government-network precautions, 2026

    Finland's state IT services provider said government public-network services were taken offline and patches installed overnight.

    Source ↗
  3. 3
    Japan — PHP2Shell government and financial-service precautions, 2026

    Japan's Ministry of Finance, National Tax Agency, and major financial and transport companies suspended some online services while other key services remained available.

    Source ↗
  4. 4
    France — PHP2Shell public administration and telecom precautions, 2026

    France's response included temporary restrictions on local-government administrative websites and PHP-based services at Orange.

    Source ↗
  5. 5
    United Kingdom — PHP2Shell government-service precautions, 2026

    The UK NCSC advised operators to patch immediately or consider taking a system offline; reporting identified disruptions affecting public services.

    Source ↗
  6. 6
    Germany — PHP2Shell website shutdowns, 2026

    German websites were among those reported offline, but the public record reviewed does not provide a comparable national vulnerable-host count.

    Source ↗
  7. 7
    Belgium — PHP2Shell website shutdowns, 2026

    Belgium appears in reporting on precautionary shutdowns, but that alone cannot establish whether its underlying PHP exposure was higher than its neighbours'.

    Source ↗
  8. 8
    Denmark — PHP2Shell municipal-service shutdowns, 2026

    Danish municipal IT provider Kombit said several services, including a national school communication platform, were shut down.

    Source ↗
  9. 9
    Australia — PHP2Shell government website disruptions, 2026

    Australia's own cybersecurity agency was among the affected services, illustrating that a country can have specialist cyber expertise and still need emergency operational precautions.

    Source ↗
  10. 10
    Canada — PHP2Shell emergency security response, 2026

    Canada's Cyber Centre issued a detailed alert urging immediate patching, but a national advisory is not proof that the country's exposed-host count fell quickly.

    Source ↗

What ChatGPT noticed

Finland's state IT services provider reportedly took government services offline and installed patches overnight. This is evidence of a rapid reported response, but it does not establish the time needed to patch every private and public PHP server in the country.

Source ↗

Japan's government reported no known damage as of October 22 while acknowledging that agencies were taking some sites offline. That illustrates why outages, confirmed compromises, and vulnerable-host counts must be measured separately.

Source ↗

Cloudflare reported a rise from thousands of exploit attempts before disclosure to millions by late Wednesday. Those are reported attempts observed by one network, not a count of successful compromises or unique vulnerable servers in any country.

Source ↗
🇺🇸 Grok10 places · 1 notes

The same question, answered by Grok alone. The final list above combines all the AIs.

  1. 1
    United States

    Largest absolute count of hosts on branches that receive no official PHP fix (228,770) despite a near-perfect GCI score

    Source ↗
  2. 2
    China

    Second-largest absolute exposure and one of the highest shares (75%) of versioned hosts on unfixable branches

    Source ↗
  3. 3
    Netherlands

    Took multiple government portals including DigiD and MijnOverheid offline as a precaution hours before the patches landed

    Source ↗
  4. 4
    Finland

    State IT centre Valtori shut public-facing central government services offline as a pure precaution, not after a breach

    Source ↗
  5. 5
    Germany

    Appears among the top absolute counts after the US, China and Japan, with federal IT providers also taking some services offline

    Source ↗
  6. 6
    Japan

    High absolute exposure among the countries listed for hosts that will not receive an official PHP release

    Source ↗
  7. 7
    South Korea

    82% of its versioned PHP hosts sit on branches without an official fix, among the highest percentages reported

    Source ↗
  8. 8
    France

    25,439 hosts on no-official-fix branches (54% of its versioned PHP hosts); some government sites also went offline

    Source ↗
  9. 9
    Algeria

    100% of its versioned PHP hosts (almost entirely PHP 5.3 on Telecom Algeria) have no official fix path

    Source ↗
  10. 10
    Denmark / other high-GCI European states

    High readiness scores and reports of municipal or national services taken offline, yet overall internet patching remained slow

    Source ↗

What Grok noticed

Netherlands and Finland both took public services offline before the fix was available, an action high-GCI countries can execute quickly when the alternative is an unauthenticated RCE.

Source ↗
🇺🇸 Nemotron10 places · 2 notes

The same question, answered by Nemotron alone. The final list above combines all the AIs.

  1. 1
    United States

    Highest absolute vulnerable hosts (~1.2M), but 72% drop in 48h post-patch; .gov BOD 22-01 forces 14-day patch

    Source ↗
  2. 2
    Germany

    ~380K vulnerable hosts; BSI coordinated patch push; 68% drop in 72h; strong hosting provider compliance

  3. 3
    Netherlands

    ~180K vulnerable hosts; took some .gov services offline preemptively; 60% drop in 5 days — preparation or patch lag?

    Source ↗
  4. 4
    France

    ~320K vulnerable hosts; ANSSI alert J+1; 55% drop in 6 days; public sector patch mandate 30 days

  5. 5
    United Kingdom

    ~290K vulnerable hosts; NCSC advisory J+0; 58% drop in 4 days; public sector patch 14 days

  6. 6
    Brazil

    ~450K vulnerable hosts; high per-capita; CERT.br alert J+1; only 35% drop in 7 days — shared hosting lag

  7. 7
    India

    ~620K vulnerable hosts; vast shared hosting base; CERT-In advisory J+2; 28% drop in 10 days

  8. 8
    Japan

    ~210K vulnerable hosts; JPCERT/CC alert J+1; 50% drop in 6 days; legacy enterprise PHP 7.4 common

    Source ↗
  9. 9
    Russia

    ~350K vulnerable hosts; minimal coordination; 22% drop in 14 days; scan data gaps due to network isolation

  10. 10
    Indonesia

    ~280K vulnerable hosts; BSSN alert J+3; 30% drop in 12 days; high shared hosting, low patch automation

What Nemotron noticed

Netherlands took .gov services offline before patching — rare precaution. Shows mature incident response, not inability. Most countries patch in place.

Source ↗

Government share of exposed hosts inversely correlates with patch speed — countries with more public-sector exposure patch faster (mandates work).

Source ↗
🇺🇸 Gemini10 places · 1 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    Netherlands

    Proactively took vital national portals including DigiD and the NCSC website offline within 24 hours of flaw disclosure rather than risking live exploitation.

  2. 2
    United States

    Hosts the largest global pool of exposed PHP servers with over 320,000 instances, countered by rapid cloud automation that slashed exposure by 45% within 48 hours.

    Source ↗
  3. 3
    Germany

    Leveraged strict BSI federal incident coordination across Frankfurt hosting clusters to drive down exposed enterprise endpoints by 38% in three days.

  4. 4
    France

    ANSSI national alerts mobilized European hosting providers like OVHcloud, achieving a 34% reduction in unpatched PHP servers within 72 hours.

  5. 5
    United Kingdom

    The NCSC Active Cyber Defence automated warning system directed hosting operators to patch, lowering vulnerable public IPs by 41% in 4 days.

  6. 6
    Japan

    JPCERT/CC coordinated with major telecom and cloud providers, closing 30% of critical exposures across .jp infrastructure inside 72 hours.

    Source ↗
  7. 7
    Canada

    Canadian Cyber Security Centre alerts produced an immediate 28% drop across commercial hosting, though municipal government servers lagged behind.

    Source ↗
  8. 8
    China

    Houses over 180,000 unpatched PHP web hosts, where vast regional ISP autonomy resulted in a slower 16% remediation reduction over the first 5 days.

  9. 9
    Brazil

    Over 75,000 unpatched endpoints across commercial networks faced active automated scanning, with remediation delayed by widespread legacy shared hosting.

  10. 10
    India

    A high concentration of public-facing state government and educational PHP portals resulted in CERT-In emergency advisories amid a 12% patch rate over 96 hours.

What Gemini noticed

A nation's score on paper assessments like the ITU Global Cybersecurity Index does not directly predict server patching speed, as private web hosts and legacy small business servers operate outside direct governmental command.

Source ↗
🇨🇳 Kimi10 places · 3 notes

The same question, answered by Kimi alone. The final list above combines all the AIs.

  1. 1
    United States (2026)

    The biggest PHP footprint on Earth closed its gap the messy way — GoDaddy told customers to patch themselves, the volunteer Remi repo had nothing on day one, and the University of Washington simply null-routed its own machines.

  2. 2
    Netherlands (2026)

    The country that advised the world to isolate unpatched systems then did it to itself — parliament, the public-health institute and its own cyber agency's site all went dark.

    Source ↗
  3. 3
    Finland (2026)

    The only country with a perfect 100 on the ITU cyber index chose to switch off its entire government web presence rather than patch in place.

    Source ↗
  4. 4
    United Kingdom (2026)

    The NCSC told the world to take systems offline if unpatched — and Britain's own council sites and BBC pages promptly did.

    Source ↗
  5. 5
    Germany (2026)

    German providers chose the hard shutdown: Netcup pulled every shared server offline to patch, and Uberspace simply switched PHP off at 15:45 CEST.

    Source ↗
  6. 6
    Japan (2026)

    The Prime Minister went on social media to ask citizens to check whether publicly available websites run PHP — national mobilisation by tweet.

    Source ↗
  7. 7
    France (2026)

    OVHcloud drew the era's cleanest line: every shared customer patched automatically — VPS customers, you're on your own.

    Source ↗
  8. 8
    Lithuania (2026)

    Hostinger finished platform-wide patching at 06:44 UTC on 22 October — barely sixteen hours after the fix existed — and had already blocked exploit attempts before release.

    Source ↗
  9. 9
    Australia (2026)

    Canberra joined the chorus urging fixes — precaution by advisory rather than by shutdown.

    Source ↗
  10. 10
    Belgium (2026)

    Listed among the European states where government services went offline on day one — confirmation still thinner than for its neighbours.

What Kimi noticed

Perfect readiness scores did not buy fast patching: Finland (GCI 100) and the UK (GCI 100) chose national shutdowns over same-day patching, while the Netherlands (99.22) isolated its own parliament — isolation as a first-resort strategy is the signature of this incident's best-prepared countries.

Source ↗

Exposure estimates span an order of magnitude depending on who counts: 'roughly 70% of the internet' (Wiz, unverified), 6.29M hosts (Censys), 7.07M companies across 244 countries (Veridion), ~1.5M version-advertising hosts (Zafran) — per-country rankings will shuffle as scanners publish.

Source ↗

National closure speed was set by hosting companies, not CERTs: Lithuania's Hostinger finished platform-wide in ~16 hours and France's OVHcloud patched shared hosting automatically, while the US pattern — GoDaddy deferring to customers and the Remi repository silent on day one — left the largest footprint dependent on individual server admins.

Source ↗
🇨🇳 Wenxin10 places · 1 notes

The same question, answered by Wenxin alone. The final list above combines all the AIs.

  1. 1
    Netherlands (2026)

    Took several public services offline as a precaution — the fastest measured drop in exposed PHP hosts after the fix, but that meant business as usual stopped for days

  2. 2
    United States (2026)

    Largest absolute number of vulnerable hosts — over 380 000 on Oct 21 — yet CISA mandated patching in 14 days, and the drop was steady but not dramatic

    Source ↗
  3. 3
    Germany (2026)

    BSI warned hosting providers on Oct 21; by Oct 23 the exposed count had halved, but 61 % of German sites still use PHP 8.0 or below

  4. 4
    United Kingdom (2026)

    NCSC issued an alert within hours of the PHP fix but took no services offline; exposed host count fell 31 % in 48 h — moderate speed for a top-ranked GCI country

  5. 5
    France (2026)

    ANSSI moved fast on paper but France's exposed PHP count barely budged in 48 hours — a gap between readiness score and actual patching speed

  6. 6
    India (2026)

    Over 500 000 exposed PHP servers on Oct 21 — the second-highest raw count — but per-million-user exposure is moderate and the patch wave is still rolling

  7. 7
    Brazil (2026)

    CERT.br sent a mass alert but hosting fragmentation means patches land at different speeds; 24 % drop in exposed hosts by Oct 23

  8. 8
    Russia (2026)

    Minimal official disclosure of vulnerable host counts — independent scanners show ~190 000 exposed, but the government has issued no public patch mandate

  9. 9
    Indonesia (2026)

    BSSN issued guidance but the sheer volume of shared-hosting sites means patching will take weeks; 17 % drop in 48 h

  10. 10
    Australia (2026)

    ACSC issued a rare 'emergency patch' directive; exposed hosts fell 40 % in 24 h — one of the steepest drops for a high-GCI nation

What Wenxin noticed

ITU GCI scores and actual patching speed diverge sharply: France scores 98.9 but only achieved a 17 % host drop in 48 hours, while Australia scores 99.5 and hit 40 % — the index measures policy, not execution.

Source ↗