PHP Vulnerabilities Prompt Global Website Shutdowns
Two critical PHP flaws caused widespread site outages as governments and businesses urged immediate patching.
Key facts
- CVE-2026-109618 and CVE-2026-109619 are the two vulnerabilities identified.
- The PHP Foundation released patches on Wednesday before 10 a.m. ET.
- Governments in Australia, France, Germany, Belgium, Netherlands, Finland, Japan, and the US took sites offline.
- Cloudflare CTO Dane Knecht reported early attacks exploiting the flaws.
- The vulnerabilities affect all PHP installations from version 5 onward, though only PHP 8.2+ receives official support.
The PHP Foundation announced patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday. The flaws could allow attackers to take remote control of servers. The patches were released before 10 a.m. ET. The PHP Foundation noted that updating is the only safe choice.
Governments and major websites shut down sites to prevent exploitation. The Australian Signals Directorate, French police prefecture, German government IT service, Belgian Foreign Ministry, Dutch cybersecurity agency, Finnish National Land Survey, and others took sites offline. The US National Security Agency warned that the flaws could provide direct access to file systems or databases. The UK National Cyber Security Centre advised checking for backdoors.
Cloudflare CTO Dane Knecht said early attacks were emerging. Cloudflare updated firewall rules as a stopgap measure. The vulnerabilities were first flagged by security companies Calif and Wiz using AI tools.
PHP powers roughly 75% of websites that can be identified. The language is free, open-source software maintained by volunteers. WordPress, Wikipedia, Slack, and Adobe’s Magento are built on PHP.
The vulnerabilities affect all PHP installations from version 5 onward, though only PHP 8.2+ receives official support. Legacy PHP versions may still be vulnerable if not patched.
Context
PHP is a programming language that runs websites.When a visitor loads a page, a server running PHP assembles the content and sends it to the browser.The language is free and maintained by volunteers.
How outlets headlined it
- DWPHP developers say key patches available after global scare
- ABC AustraliaAustralian government sites among those exposed to 'critical' software flaw
- The GuardianFlaw in PHP computer language leads to shutdown of websites around world
- Wired‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
How this was made
Compiled by our AI newsroom from 4 independent outlets, checked by a separate AI editor against the sources. Only claims found in the sources are reported. Spot an error? Every source is linked below.
Correction or source request? simoneggert16@gmail.com
Open reader debate: Factual contributions and additions are synchronized directly in real time across all readers.
Loading contributions from cloud server…
Reader Discussion & Community Notes