Full Breakdown
Massive PHP Hypertext Preprocessor (PHP) Flaws Prompt Government Websites to Go Dark
By Drooid · · How we work
Core Event: Critical PHP Vulnerabilities Trigger Emergency Shutdowns
On October 21, government portals across Europe—including sites in Belgium, the Netherlands, Finland, France and Germany—were taken offline as operators rushed to apply emergency patches for two newly disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The PHP development team released emergency updates for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging all users to upgrade immediately. Organizations unable to patch were advised to isolate or shut down exposed services.
Background & Context
The flaws were first reported by security firm Calif on August 11, with a second independent discovery by Wiz on August 24. On October 20, the PHP Foundation issued an advisory warning of the imminent threat and announced that a patch would be released the following day. The vulnerabilities enable unauthenticated remote-code execution, allowing an attacker to run arbitrary commands on a server without a login.
Data & Statistics
- Both flaws received a CVSS v4.0 severity score of 9.2 (critical).
- PHP powers roughly 70-75 % of known server-side websites.
- Estimates suggest 1.3 – 1.9 million internet-exposed hosts run vulnerable PHP versions.
- About 758 000 installations use end-of-life branches, while only 272 000 run supported releases (VirusTotal data).
Official Statements & Responses
- CERT-EU warned the vulnerabilities could affect every PHP version from 5 onward and recommended immediate patching or temporary offline isolation.
- The Australian Cyber Security Centre (ACSC) issued similar guidance, noting no confirmed active exploitation at the time of the advisory.
- The U.S. NSA and CISA advised organizations to monitor for signs of compromise and to apply the patches as soon as they become available.
- Cloudflare’s CTO Dane Knecht reported early attack attempts and the deployment of temporary Web Application Firewall (WAF) rules to block known exploit vectors.
Verbatim Quotes
- “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” — Jake Knott, The Register
- “Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available,” — CERT-EU, The Register
- “PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities.” — Dane Knecht, Cloudflare CTO
On-the-Ground Reports
- Belgium, Netherlands, Finland, France, and Germany temporarily disabled public portals, including the Dutch National Cyber Security Centre and the Finnish state IT centre Valtori.
- The Wikimedia Foundation took down several services as a precaution.
- Private sector sites such as the Port of Rotterdam, the Dutch Football Association and multiple political party websites also went offline pending remediation.
Why It Matters / Impact
The scale of PHP’s adoption means a single exploitable flaw can expose millions of servers simultaneously. AI-assisted hacking lowers the barrier for developing complex exploits, making mass-scale attacks more feasible. Small-site operators on shared hosting are especially vulnerable because they often lack direct control over the underlying PHP runtime.
What’s Next
The emergency patches are now publicly available; administrators must verify their PHP version and apply the appropriate update. Organizations unable to patch immediately should follow the isolation guidance issued by CERT-EU, ACSC, NCSC and other national agencies. Security firms expect a surge in scanning and exploitation attempts shortly after release, and CDN providers are continuously updating WAF rules to mitigate emerging attack vectors. Ongoing monitoring by national cyber-security agencies will determine whether the vulnerabilities are actively exploited in the wild.