Critical PHP security flaws trigger global website shutdowns as developers release urgent fixes

Critical vulnerabilities in the widely used PHP programming language have prompted government website shutdowns across Europe and urgent cybersecurity warnings worldwide, after developers released emergency patches for flaws potentially exposing millions of servers to attacks.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on 21 October 2026, triggering precautionary shutdowns and emergency updates across government agencies, technology companies and other organisations.

PHP developers confirmed that four patches addressing the two critical vulnerabilities were available and strongly encouraged users to update their installations immediately.

The PHP Foundation, which oversees the programming language's development and maintenance, also acknowledged a significant delay in addressing earlier indications of one vulnerability, describing the handling of the issue as a “structural failure”.

The disclosure has intensified concerns about the security of internet infrastructure, particularly as artificial intelligence (AI) tools could accelerate efforts to identify and exploit weaknesses in unpatched systems.

Government websites taken offline across Europe

Government agencies and major online services temporarily disabled websites and systems on 21 October 2026 as administrators worked to assess their exposure and install security updates.

Affected services included the Dutch cybersecurity agency, the Port of Rotterdam, the Dutch government information portal Overheid.nl, Finnish government network services and websites operated by France's Interior Ministry.

Wikipedia's operator and the Internet Archive also briefly disabled systems while applying patches.

The precautionary shutdowns reflected concerns that the vulnerabilities could allow attackers to compromise servers before administrators had sufficient time to deploy the newly released fixes.

Technology companies also warned that some hackers were already attempting to exploit the flaws, although the extent of any successful attacks remained unclear.

Critical flaws could allow remote code execution

The vulnerabilities involve an out-of-memory condition that can cause memory corruption and, under certain circumstances, enable unauthenticated remote code execution on servers running PHP.

Such exploitation could potentially allow attackers to execute malicious instructions without first obtaining legitimate access credentials.

The United States National Security Agency (NSA) warned that the vulnerabilities “often provide a direct path to the server’s file system or database”.

The agency advised organisations unable to install updates immediately to take affected systems offline for full mitigation.

The US Cybersecurity and Infrastructure Security Agency (CISA) similarly called for immediate action.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organisations if left unpatched,” the agency said in an advisory.

UK cybersecurity authorities issue urgent warning

The United Kingdom's National Cyber Security Centre (NCSC) urged organisations to respond immediately to the two vulnerabilities, warning that all PHP versions were affected.

Its warning also covered software products that bundle PHP, potentially extending exposure beyond organisations operating standalone PHP installations.

The NCSC advised administrators to identify all systems using PHP, prioritising those directly accessible from the internet.

Organisations were instructed to install the fixed releases promptly or implement temporary mitigations recommended by the PHP development team if immediate updates were impractical.

Where neither option was feasible, the agency advised taking vulnerable systems offline and examining them for possible signs of compromise.

The guidance underscored the importance of identifying PHP installations embedded within other software, rather than limiting security checks to directly managed web servers.

PHP Foundation acknowledges delayed response

The PHP Foundation disclosed that indications of one vulnerability had first emerged in 2024, when a security researcher identified concerns involving the programming language.

According to the foundation's blog post, the potential weakness was recognised but did not initially produce a demonstrable exploitation method.

The issue was “theorised, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns”, the foundation said.

It subsequently acknowledged that the delay in addressing the flaw represented a structural failure in its security processes.

The disclosure raised questions about how open-source software projects assess emerging security concerns, particularly when researchers identify theoretical weaknesses before practical exploitation techniques become apparent.

Developers said the newly released updates addressed both critical vulnerabilities and urged organisations to deploy the fixes without delay.

AI tools uncover long-standing weaknesses

Cybersecurity companies Calif and Wiz independently identified the vulnerabilities with assistance from AI tools, according to accounts of the discovery.

Their findings were coordinated with the PHP development team and OpenAI as efforts began to develop and distribute fixes.

The vulnerabilities had reportedly remained within the PHP codebase for more than a decade before their public disclosure.

Wiz said exploiting the weaknesses would have been extraordinarily difficult for a human attacker, but suggested AI capabilities could substantially reduce those technical barriers.

Security specialists warned that attackers could use automated tools to reverse-engineer publicly released patches, identify vulnerable installations and develop exploitation methods.

Such concerns have intensified the urgency surrounding software updates, as publicly available fixes can reveal technical information about the weaknesses they address.

Millions of websites potentially exposed

PHP is used by approximately 75 per cent of websites whose server-side programming language can be identified, making it a major component of global internet infrastructure.

The language supports widely deployed content management and e-commerce platforms, including WordPress, Drupal, Joomla and Magento.

Data from internet infrastructure monitoring company Censys suggested that approximately 1.5 million of 2.6 million identified hosts were running versions without an available fix.

The figures indicate the potential scale of exposure, although they do not establish how many systems have been compromised.

Smaller websites operating on shared hosting infrastructure were considered particularly vulnerable because their administrators may depend on external hosting providers to deploy updates.

The vulnerabilities also raised concerns for organisations operating legacy applications or software packages containing PHP components that might not be immediately visible to security teams.

OpenAI launches coordinated security response

OpenAI said it had led a coalition of software maintainers, cybersecurity researchers and security providers to address the PHP vulnerabilities through an initiative called “Patch the Planet”.

The company said Calif discovered the weaknesses using GPT-5.6 Sol, while Wiz independently reported the vulnerabilities.

OpenAI described the incident as one of the most impactful security issues in recent memory, citing PHP's widespread use and the potential consequences of exploitation.

It said AI-assisted discovery had created an opportunity for defenders to prepare and distribute fixes before attackers could fully exploit the vulnerabilities.

The company referred to this period as a “Defender’s Window”, during which coordinated action could reduce exposure across affected systems.

OpenAI also proposed a five-stage framework for responding to critical software vulnerabilities, including validating fixes, coordinating security guidance and involving government agencies.

As part of its broader security initiative, OpenAI committed US$1 billion in subsidised Daybreak access for under-resourced defenders, alongside additional support for open-source software maintainers.

The company also invited feedback from the cybersecurity community on its proposed approach to vulnerability disclosure and coordinated defensive action.

Organisations urged to prioritise patching

Cybersecurity authorities have emphasised that immediate patching remains the principal protective measure against the two vulnerabilities.

Organisations operating PHP-based infrastructure have been advised to review their installations, identify exposed systems and ensure that updates are applied across affected environments.

Temporary mitigations recommended by the PHP development team remain an alternative for systems that cannot be updated immediately.

Authorities have also advised administrators to investigate potential compromise, particularly where vulnerable servers were publicly accessible before patches became available.