Government and public-service websites in several European countries were taken offline on Wednesday, October 21, after the disclosure of two critical security flaws in PHP, the programming language that runs a large share of the world’s websites. The PHP project released fixed versions the same day and told all users to update immediately, while cybersecurity agencies warned that attackers could move quickly to exploit servers that remain unpatched.
What the flaws are
The two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 out of 10. According to the European Union’s cybersecurity team CERT-EU, both can let an attacker run their own code on a web server without any password. One stems from the way PHP handles running out of memory in the middle of a request, which can leave corrupted data behind. The other lets leftover internal data from one request be reused by the next request handled by the same worker.
Because the problem sits in PHP itself rather than in any particular website’s code, it affects sites built on WordPress, Drupal, Joomla, Magento and MediaWiki, the software behind Wikipedia. The fixes are in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older versions have reached end of life and will not get a patch, so their users need to upgrade.
Found with the help of AI
The flaws were uncovered by the cloud security firm Wiz, owned by Alphabet, which said it used its own autonomous research tool together with frontier AI models from Google and OpenAI. Wiz said the weaknesses had been in the PHP code for more than a decade, and that chaining them into a working attack would have been extremely hard for human researchers alone. The company has compared the discovery to Heartbleed in 2014 and Log4Shell in 2021, two earlier bugs that exposed huge parts of the internet.
All servers using any version of PHP released in the last 20 years will be vulnerable.
Tiffany Farriss, interim chief executive, Drupal Association
Who went offline
In the Netherlands, the national cybersecurity centre took its own website down as a precaution, and organisations including the government portal Overheid.nl, the Port of Rotterdam, the national football association and several hospitals followed. Finland’s state IT provider took government public network services offline, France’s Interior Ministry put all its websites into maintenance mode, and a Danish municipal IT company shut down services including the national school communication platform. The Wikimedia Foundation, which runs Wikipedia, said it had taken some systems down until they could be patched.
Agencies in Britain, Switzerland, Australia and Japan urged organisations to update at once or disconnect systems that cannot be fixed quickly. Japanese Prime Minister Sanae Takaichi also asked website owners on X to check whether their sites use PHP.
Why it matters and what comes next
PHP powers roughly three-quarters of websites whose programming language can be identified, according to the web technology tracker W3Techs. CERT-EU said technical details and early proof-of-concept attacks were already circulating, which raises the chance of active exploitation. Security experts warned that small websites on shared hosting, where owners do not control the server themselves, may stay exposed longest. Swiss authorities advised site owners to get confirmation of the fix from their hosting providers and to check their logs for signs of a break-in, since patching does not undo a compromise that has already happened.
