As a precaution following discovery of a critical, globally relevant cybersecurity vulnerability, the Magyarország.hu portal and several other Hungarian government websites were temporarily taken offline overnight. According to a Facebook post by Tanács Zoltán, Minister of Science and Technology, no clear signs of a successful cyberattack have been detected so far, but online services are expected to be limited or suspended for up to 48 hours while the vulnerability is fully remediated.
What the flaw is
The issue stems from a vulnerability in the PHP programming language known as PHP2Shell. Tanács noted that PHP is used by roughly 70 percent of the world’s websites, which gives the flaw a potentially global impact. Several European countries — including the Netherlands, Finland, Denmark and France — have had to take government and public-service systems offline; parts of services provided by the Wikimedia Foundation and the BBC were also affected.
Official alert and guidance
The Nemzeti Kibervédelmi Intézet (National Cyber Defence Institute) issued a critical alert on October 21 with a severity rating of 9.2. The institute recommended immediate installation of security updates and, where that is not possible immediately, temporary restriction of affected services. Authorities urged Hungarian businesses to have their IT teams urgently check whether their websites are affected and to take the necessary steps to eliminate the vulnerability.
Discovery and exploitation risk
Two cybersecurity firms, Calif and Wiz (an Alphabet affiliate), independently discovered the flaws using artificial intelligence. Wiz stated that human analysts would have struggled to weaponize the vulnerabilities, but AI bridged that gap and could produce working exploit code. The two companies worked with the PHP development team and OpenAI to prepare patches.
Amazon’s head of security reported that on October 17 — four days before public disclosure — they already detected an attempted attack against one of their honeypots, and that since then attackers have been "widely exploiting" the flaws. Experts warn that AI-driven tools can rapidly turn published fixes or technical details into exploit code, creating a race between deploying updates and attackers weaponizing the vulnerability.
Who is most at risk
Smaller organizations and individual site operators with limited technical resources are particularly vulnerable, especially those hosting sites on shared hosting platforms without direct access to server configuration. Restoring services depends on applying updates and completing integrity checks across affected systems.
What users should expect
Some government online services will likely remain unavailable or restricted for up to 48 hours while authorities and providers apply patches and verify systems. Officials say the precautionary outages are intended to protect user data and maintain service integrity.
Closing note
Authorities and service providers are continuously monitoring the situation. Ongoing coordination aims to restore secure operation and prevent further incidents.
(This article was prepared with assistance from an AI tool; the final content was edited and verified by our journalist.)
