In the summer of 1858, an exceptional heat wave settled over London. The Thames, already the city’s open sewer, carried the accumulated waste of a rapidly growing metropolis. As the water level dropped, the filth baked on the exposed mud and released a stench that invaded the newly completed Houses of Parliament. Curtains were soaked in chloride of lime. The measure failed. Members of Parliament abandoned rooms overlooking the river. Some contemplated relocating the legislature altogether. For years the sanitary crisis had been documented, debated and deferred.

Only when the consequences entered the chamber itself did Parliament act. Within 18 days, a bill was passed authorizing the financing of a comprehensive sewer system. Engineer Joseph Bazalgette, who had already prepared plans while earlier proposals languished, was finally given the means to begin. Construction took years and was completed only in the mid-1870s. The decisive political fact remains: A chronic failure of invisible infrastructure became urgent the moment those who controlled public resources could no longer avoid its consequences.

From Thames to server

In 1858, the crisis reached Parliament through its windows. In October 2026 it reached governments through their websites.

On Oct. 21, government and other public websites in several countries were taken offline as a precaution against two critical vulnerabilities in PHP, the open-source programming language that still underpins a substantial share of the world’s websites. In the Netherlands, some digital identity services were also suspended.

PHP handles the everyday work of receiving requests, managing memory and recovering from errors. The flaws could, under certain conditions, allow an attacker to execute code remotely on a vulnerable server without authentication.

Emergency security updates were released the same day. Precautionary shutdowns should not be read as confirmed successful attacks. The Dutch National Cyber Security Center later assessed that exploitation was more complex and large-scale abuse less likely than first feared. The episode nevertheless exposed a deeper institutional reality. According to Reuters reporting on Oct. 23, the PHP Foundation supporting this globally significant software had one full-time employee, Executive Director Elizabeth Barron, and 14 predominantly part-time contractors.

Signs of the underlying out-of-memory problem had already appeared in 2024 during follow-up work after an external security audit. At that stage, full exploitability was not established. Technical complexity, compatibility concerns, consensus decision-making, and limited resources delayed resolution.

In August 2026, researchers working with Calif and OpenAI independently reported the same root cause and helped demonstrate its severity. Other researchers and AI-assisted testing contributed to the broader investigation. The subsequent scramble was not caused by artificial intelligence (AI) acting alone. It was produced by the sudden visibility of a long-neglected weakness in software that governments and large organizations had come to treat as permanent background infrastructure.

Economics of digital infrastructure

Twelve years earlier, the Heartbleed vulnerability in OpenSSL had already illustrated the same pattern. OpenSSL secured a large proportion of internet communications. When the flaw was disclosed in 2014, it became an international emergency, revealing that an essential open-source project had been sustained on minimal funding, on the order of a few thousand dollars a year in donations.

The crisis prompted the Linux Foundation’s Core Infrastructure Initiative, through which major technology companies pledged support for critical open-source projects. Governments and corporations had built valuable services atop OpenSSL while the cost of maintaining its security was borne by a small team. This is the classic problem of a public good. Collective dependence coexists with collective free-riding. Open-source software is not inherently insecure. The mismatch lies between the breadth of reliance and the narrowness of sustained investment. Why, then, does society repeatedly discover the strategic value of essential digital infrastructure only after a security crisis has made its neglected foundations impossible to ignore?

When discovery outruns repair

AI is now widening that gap. Advanced AI tools accelerate the discovery and verification of vulnerabilities, as the PHP Foundation itself has acknowledged in its use of such systems for auditing and for grouping related reports. The volume of security reports and proposed code changes has increased sharply. Yet experienced engineers remain essential to judge the validity of findings, assess compatibility risks, develop patches and coordinate releases.

The 2024-2026 timeline for the PHP issues shows how difficult it remains to convert security knowledge into deployable fixes under conditions of technical complexity and limited capacity. Greater knowledge of hidden weaknesses can therefore produce greater short-term disruption if institutions lack the resources to respond at the same pace.

The PHP episode also illustrated the temporal politics of disclosure. Disagreements and leaks surrounding timing, the premature circulation of identifiers, and the unilateral publication of patched packages by some parties complicated the effort to inform defenders without handing attackers a practical advantage before patches could be widely deployed.

This is a governance problem, rather than a technical one. Public institutions must now maintain, coordinate and decide at a speed that matches AI-enabled discovery. The alternative is a recurring cycle in which newly illuminated risks force precautionary outages before the underlying maintenance deficit can be closed.

For a middle power such as Türkiye, which continues to invest in digital public administration and technological autonomy, the implication is sharper than a generic call for more cybersecurity spending. Digital sovereignty requires the ability to understand, maintain, repair and sustain the software foundations on which those services rest. It is beyond the capacity to develop national platforms or launch digital services. This means knowing which critical public functions depend on which components, treating software maintenance as an enduring public responsibility rather than a one-time procurement expense, contributing to the open-source ecosystems that public institutions rely upon, retaining sufficient in-house expertise to evaluate vulnerabilities and coordinate responses, and preserving continuity of essential services while emergency measures are applied. The ability to maintain digital systems is as strategically important as the ability to construct them.

London eventually buried its sewage because the alternative became politically intolerable. The 21st-century state confronts an equivalent choice beneath the interfaces of its digital administration: either govern the invisible infrastructure that now carries the functions of government, or continue to rediscover its necessity only when the services themselves go dark.