Emergency security updates have been released for two critical PHP flaws that could expose websites to remote code execution attacks. Governments, businesses and online services are applying patches and reviewing their systems as security experts warn that vulnerable installations could remain at risk.
Websites and organizations around the world are racing to address critical vulnerabilities in PHP, one of the internet’s most widely used programming languages.
The flaws could allow attackers to execute malicious code remotely, potentially leading to website takeovers, data theft and malicious redirects. PHP has released emergency security updates, but organizations must still identify vulnerable systems, install the appropriate fixes and verify that their websites are protected.
Although reports of widespread outages have emerged, the immediate disruption has largely involved organizations temporarily taking websites and services offline as a precaution while applying security updates.
What has happened?
The security concerns came to light on October 21, 2026, when PHP announced two critical vulnerabilities and issued an advisory ahead of its security releases.
The vulnerabilities were identified as:
-
CVE-2026-109618: An out-of-memory handling bug.
-
CVE-2026-109619: A use-after-free memory error.
According to the report, both vulnerabilities received a severity score of 9.2 out of 10, placing them in the critical category.
The flaws could expose affected systems to remote code execution, a type of attack in which an attacker can run malicious code on a vulnerable system. Depending on the environment and the attacker’s access, the consequences could include compromised websites, stolen information and unauthorized changes to online services.
PHP has released fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should identify which PHP versions their systems use and follow the official security guidance to upgrade to the appropriate patched release.
Which websites and organizations have been affected?
The potential reach of the vulnerabilities is substantial because PHP powers a large proportion of websites and web applications. However, using PHP does not automatically mean a website is vulnerable; exposure depends on factors including the version in use and the relevant configuration.
The reported response has included temporary shutdowns and precautionary security measures across several European countries.
Government websites taken offline
According to reports cited by TechRadar, several government organizations temporarily restricted access to websites while assessing and addressing the vulnerabilities.
-
Germany: The federal IT service provider ITZBund reportedly took several websites offline as a precaution.
-
France: The Interior Ministry temporarily shut down websites belonging to local government administrative offices while awaiting security patches.
-
Belgium: The Foreign Ministry temporarily took its websites offline following reports of attacks exploiting the vulnerabilities, although the report did not confirm that the vulnerabilities were responsible.
-
The Netherlands: The National Cyber Security Centre took its public-facing websites offline. Websites associated with the Port of Rotterdam, the Dutch football association KNVB, major political parties and hospitals were also reported to have been affected.
Some of these services were subsequently restored.
Wikipedia and other online services
Wikipedia and its associated Wikimedia content platform reportedly experienced outages, although both appeared to be back online at the time of the report.
In the United Kingdom, government representatives acknowledged that some services might be unavailable while security work continued. The report also cited a government minister as saying that 32 government services were offline because of the security threat.
The UK government reportedly said that no major public-facing critical services had been affected, while work to identify and address potential exposures continued.
These disruptions do not necessarily indicate successful cyberattacks. In several cases, organizations took services offline to reduce risk while installing fixes or checking their systems.
Orange temporarily suspends websites and apps
French telecommunications company Orange confirmed that it had temporarily suspended access to certain websites and applications after the vulnerabilities were disclosed.
The company said the decision was a precautionary measure that allowed it to deploy the required security patches and carry out additional checks before restoring affected services.
Orange apologized for the disruption and said the affected websites and applications would be progressively brought back online.
The incident illustrates a difficult trade-off for organizations: taking services offline can disrupt customers and business operations, but leaving vulnerable systems exposed may create a more serious security risk.
Why the PHP vulnerabilities matter
PHP, short for PHP: Hypertext Preprocessor, is a server-side programming language used to build and operate websites and web applications.
When a visitor opens a website, PHP can process information, interact with databases and generate the content delivered to the visitor’s browser. It is widely used across the web, making security weaknesses in the language potentially consequential.
The concern is not simply the existence of a software bug. It is the possibility that an attacker could exploit a vulnerable installation to gain control over a system or use it as a starting point for further attacks.
Possible consequences include:
-
Unauthorized access to website infrastructure.
-
Theft of sensitive information.
-
Malicious redirects to fraudulent or harmful websites.
-
Changes to website content.
-
Disruption of online services.
-
Further compromise of connected systems, depending on the environment.
The extent of any damage would depend on whether a vulnerable installation could be exploited and what access an attacker could obtain.
What should businesses do immediately?
Security experts are urging organizations to act quickly rather than wait for evidence of an attack.
Matt Cooke, EMEA cybersecurity strategist at Proofpoint, warned that businesses have a limited window to strengthen their defenses as attackers increasingly operate at machine speed.
His advice centers on three priorities: patch vulnerable systems, understand the organization’s attack surface and limit the potential damage if an intrusion occurs.
For organizations running PHP-based websites, the following steps are especially important.
1. Install the relevant security updates
Administrators should identify their PHP versions and apply the appropriate patches as soon as possible. They should also verify that the update was successfully installed and that the affected services are running the patched version.
Organizations using managed hosting services should confirm whether their providers have applied the fixes.
2. Identify every PHP installation
Large organizations may have overlooked older websites, internal applications, test environments or forgotten servers during an initial remediation effort.
A complete inventory of internet-facing assets and PHP installations can help identify systems that remain exposed.
3. Back up websites and important data
Small businesses should ensure they have reliable backups of website files, databases and other essential information.
Backups should be stored securely and tested to confirm that they can be restored if a website is damaged or needs to be rebuilt.
4. Monitor systems for suspicious activity
Organizations should review security logs, monitor unusual traffic and investigate unexpected changes to website files or configurations.
Patching is essential, but businesses should not assume that installing an update automatically resolves every concern if a system may already have been compromised.
5. Watch for phishing and related scams
High-profile security incidents often create opportunities for scammers to impersonate hosting providers, software vendors or security teams.
Businesses should be cautious about unsolicited messages claiming that an account is compromised or that an urgent download is required. Security updates should be obtained through trusted official channels.
Advice for small businesses and website owners
Smaller organizations may lack dedicated security teams, but they can still take meaningful steps to reduce their exposure.
Website owners who rely on an external hosting provider should contact the provider to establish:
-
Whether their website uses PHP.
-
Whether the installed version is affected.
-
Whether the relevant security updates have been applied.
-
Whether any temporary service disruption is expected.
-
Whether the provider has detected suspicious activity.
Businesses should also confirm that their backups are current and recoverable, and avoid making rushed changes based on unverified messages or online rumors.
Even a short website outage can affect sales and customer confidence. However, a temporary interruption to apply security updates may be preferable to leaving a vulnerable service accessible to attackers.
How AI helped uncover the vulnerabilities
The incident has also highlighted the growing role of artificial intelligence in cybersecurity research.
According to the report, researchers at cybersecurity firm Calif had identified potential PHP issues as early as 2024. Their work was later accepted into OpenAI’s Patch the Planet initiative in July 2026, which aims to use advanced AI systems to identify and help address security vulnerabilities.
Calif reportedly uncovered a more serious PHP issue in August 2026, which OpenAI’s systems identified shortly afterward. Researchers, maintainers and security providers then worked together on remediation.
OpenAI described the vulnerabilities as a reminder that AI can help discover software weaknesses with potentially enormous consequences, while warning that the same capabilities could help malicious actors develop offensive tools and exploits more quickly.
The episode demonstrates both sides of AI-assisted security research: the technology can help defenders identify flaws before attackers exploit them, but it also increases the importance of coordinating disclosure and deploying fixes quickly.
Open-source security faces renewed scrutiny
The PHP incident has renewed questions about the security of open-source software, which underpins much of the modern internet.
Open-source projects can benefit from broad collaboration, transparency and contributions from developers around the world. However, widely used projects can also depend on relatively small groups of maintainers to review code, investigate vulnerabilities and produce fixes.
Gunnar Hellekson, vice president and general manager at Lightwell, Red Hat, said the incident highlighted how deeply open-source software is embedded in systems supporting global business.
Chris Dimitriadis, chief global strategy officer at ISACA, also warned that a single vulnerability can create cascading effects across industries and national borders because modern organizations rely on interconnected digital infrastructure.
Their broader point is that cybersecurity cannot begin only after a vulnerability becomes headline news. Organizations need to understand their technology dependencies, establish clear response procedures and invest in the expertise required to manage risks before a crisis develops.
What happens next?
At the time of TechRadar’s latest update, the situation appeared relatively quiet in terms of major new outages affecting widely used services. However, that did not mean the danger had passed.
Security vulnerabilities can remain exploitable on systems that have not been updated, and attackers may continue searching for vulnerable installations after an issue becomes public.
The coming days and weeks will therefore be important as organizations complete patching, investigate potential exposure and restore services that were taken offline.
For now, the immediate priorities are clear: apply the relevant PHP security updates, identify overlooked installations, monitor for suspicious activity and verify that critical services are protected.
The incident is also a reminder that the security of widely used software is a shared responsibility. Developers and maintainers must respond to vulnerabilities, hosting providers must secure their infrastructure, and organizations must ensure that available fixes actually reach the systems they operate.