PHP security flaws prompt government website shutdowns
Fixes are available for two vulnerabilities rated 9.2 out of 10, while security firms have reported attempted attacks without confirmed success.
Governments and businesses across several countries temporarily disabled websites in response to two PHP vulnerabilities that can let unauthenticated attackers execute code remotely on servers. PHP’s development team issued fixes and called for immediate updates.
Identified as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities affect every PHP installation handling web requests, including WordPress, Drupal and Joomla platforms. Their severity rating is 9.2 out of 10. Updated versions containing fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The European Union’s computer emergency response team recommended disconnecting exposed applications from the internet if updates cannot be installed immediately. Its advisory said publicly circulating proofs of concept increased the likelihood of exploitation. Security firms have reported attempted attacks, but have not confirmed any success.
According to specialist press reports, precautionary shutdowns in the Netherlands included parliamentary websites and the DigiD digital identity service. Finland disabled several public services, while France took prefecture websites offline. Websites in Denmark and Australia, along with major Japanese platforms, were also taken down.
Japan’s Prime Minister Sanae Takaichi called for checks of PHP-based public websites and preparations to install the fix. The US National Security Agency urged update preparations, while the US Cybersecurity and Infrastructure Security Agency and the UK’s National Cyber Security Centre pressed for prompt patching.
