Critical PHP Flaw: Global Website Takedowns & Patches (2026)

A critical PHP vulnerability disclosed on 21 October 2026 has forced government agencies across Europe and beyond to take websites offline as they scramble to apply emergency patches. PHP, the open-source scripting language powering roughly 70% of websites with identifiable languages, including WordPress, Wikipedia and Slack, contains two flaws that allow unauthenticated remote code execution. The severity prompted precautionary takedowns in Belgium, the Netherlands, Finland, France and Germany, with the Dutch national digital identity service and the Port of Rotterdam among the high-profile systems temporarily suspended.

What is the PHP Vulnerability and How Was It Found?

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and affect PHP versions 5.4 through 8.5.11. Security researchers aided by artificial intelligence identified the decade-old vulnerabilities, which the PHP Foundation described as the most significant ever found by AI. Patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October. Apache with mod_php is especially exposed, though PHP-FPM, php-cgi, FrankenPHP and LiteSpeed may also be affected. This incident highlights the risks in open source security flaws that can remain hidden for years.

Which Government Websites Were Taken Offline?

Precautionary shutdowns swept across Europe on 21 October. In the Netherlands, Overheid.nl, MijnOverheid.nl, DigiD, the Port of Rotterdam, the KNVB, major political party sites and hospital websites all went dark. Finland suspended Valtori services, France took the Paris police prefecture offline, and Belgium and Germany followed with their own public-facing systems. Denmark shut down Kombit, while UK councils in Edinburgh, Bristol and Oxford and Australia's Signals Directorate were also briefly affected. The US National Security Agency and the UK National Cyber Security Centre urged organisations to take systems offline if they could not patch immediately. This wave of takedowns underscores the fragility of European government digital services.

How to Patch and Protect PHP Systems

Security agencies recommend a structured response to the critical PHP vulnerability. Follow these steps to reduce exposure:

1. Inventory all PHP installations, including shared hosting and legacy applications.
2. Prioritise internet-facing systems that accept untrusted input.
3. Apply patches 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use vendor backports.
4. Verify cloud workload updates and container images.
5. Review server logs for suspicious activity or exploit attempts.
6. Safely restore suspended services only after confirmation.

Cloudflare's Dane Knecht called firewall rule updates a STOPGAP only, emphasising the need for emergency patch management. Organisations should also run vulnerability scanning tools to confirm remediation.

Global Impact and What Experts Are Saying

Amazon reported an exploit attempt on a honeypot four days before the public disclosure, suggesting attackers were already probing the flaws. Because PHP underpins WordPress and many content management systems, experts warn of a long tail of unpatched sites on shared hosting. Firewall rule updates are a STOPGAP only, said Dane Knecht of Cloudflare, urging immediate patching. Cyber agencies in Europe, Australia, Japan and Britain issued alerts, and AI-assisted attacks could magnify the threat. This fast-moving event is a test of global cybersecurity incident response coordination.

FAQ

What is the PHP vulnerability?

It is a pair of critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running PHP.

Which PHP versions are affected?

PHP 5.4 through 8.5.11 are affected. Patches are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Why were government websites taken offline?

Governments took sites offline as a precaution because the flaws could give attackers direct access to server file systems before patches were applied.

Is WordPress affected?

Yes, WordPress runs on PHP, so any WordPress site using an unpatched PHP version is at risk until the server software is updated.

How do I protect my website?

Apply the patched PHP version immediately, prioritise internet-facing systems, review logs, and use a web application firewall as a temporary stopgap.

Conclusion

The critical PHP vulnerability of October 2026 is a reminder that foundational open source software can carry hidden risks. Governments and businesses must patch now and monitor for follow-on attacks as the long tail of unpatched systems is likely to persist for months.