Major Websites Go Dark to Protect Against New Vulnerability
Left 50%
Center 0%
Right 50%
1 left · 0 center · 1 right
What happened
On Wednesday, major websites in the United States and Europe temporarily went offline as operators sought to protect systems from newly disclosed vulnerabilities in PHP, an open-source programming language that cybersecurity firm Cloudflare says nearly 70 percent of websites use, including those built on WordPress, Drupal, and Joomla. The flaws, dubbed "PHP2Shell," carry critical severity ratings of 9.2 out of 10; researchers at cybersecurity firm Wiz demonstrated that hackers could exploit them to seize control of servers without logging in, and Cloudflare reported detecting attacks targeting the flaws, although widespread successful breaches have not been confirmed. Sites that went dark included the U.S. internet forum Something Awful; supporting services of the Wikimedia Foundation, which operates Wikipedia; and government websites in Germany, France, Belgium, Finland, and the Netherlands, where hospitals, political organizations, and the Port of Rotterdam were among those affected. PHP developers released emergency security patches the same day and warned that temporary safeguards cannot fully protect vulnerable systems. The PHP Foundation acknowledged that signs of one underlying problem had surfaced during a 2024 security audit but remained unresolved amid technical challenges and limited engineering resources.
Sourcing check · Mostly on the record · 2 articles
1 of 2 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 1 of 2
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Cloudflare and PHP Foundation
- Primary evidence · cites a document or data 1 of 2
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: security advisory, research report
- Credits another outlet 0 of 2
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 2
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 21, 18:06 UTC by New York Post, naming its source. First document in the first report, from New York Post (security advisory).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Right-leaning coverage is more complete on what went dark and why, because left-leaning coverage never names the software or the operators. The Atlantic says only that parts of the internet are going dark to protect against a newly discovered vulnerability. Right-leaning coverage names the PHP2Shell flaws in PHP, a language used by nearly 70% of websites. Germany, France, Belgium, Finland and the Netherlands took government websites offline, the New York Post reports. The Wikimedia Foundation disabled supporting services.
Left-leaning coverage leads with a warning to read this website "while you still can." Right-leaning coverage leads with operators in the US and Europe racing to protect systems from hackers. Hackers appear in the right-leaning opening and nowhere in left-leaning coverage.
Were any of the hospital or port shutdowns triggered by a confirmed intrusion, or did every operator go dark only as a precaution?
Bottom line
The New York Post reported that a 2024 audit left a PHP problem unresolved amid limited engineering resources. The Atlantic never named PHP at all.
The receipts — 3 facts one side's coverage lacks
- Nearly 70% of websites use PHP
- The flaws carry critical severity ratings of 9.2 out of 10
- Hospitals, political organizations and the Port of Rotterdam were among those affected in the Netherlands
The Left View
The Atlantic frames the incident as an urgent, reader-facing crisis of access, headlining its coverage "Read This Website While You Still Can" and stating that "parts of the internet are going dark" to protect against the newly discovered vulnerability. Its coverage treats the protective blackout itself—and the implication that online spaces may vanish—as the central story.
The Right View
The New York Post frames the shutdowns as operators racing to protect systems from hackers who could be given "control of servers," stressing detected attacks, the demonstration of unauthenticated takeover, and the critical severity rating. It also foregrounds the PHP Foundation’s acknowledgment that a related 2024-audit problem "remained unresolved amid technical challenges and limited engineering resources," presenting the episode as both an active cyber threat and a consequence of under-resourced maintenance.
Our Take (balanced)
The left’s strongest argument is that the public consequence—sites going dark—is the story, distilled in the Atlantic’s "Read This Website While You Still Can." The right’s strongest argument, backed by reported attack detection, the unauthenticated-control demonstration, and the Foundation’s admission that a 2024 finding sat unresolved under resource constraints, is that this is a high-severity race against exploitation of under-maintained software. The central unresolved tension is whether the episode is primarily a sudden public-access crisis or a story about known, unpatched weaknesses in widely used open-source software.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.