Governments and companies around the world spent this week racing to fix two serious security flaws in PHP, a programming language behind much of the web.
What happened
Government websites in Europe and elsewhere went offline on Wednesday, October 21, after the flaws were disclosed. In Europe, sites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were temporarily taken down while fixes went in. Some users also couldn’t reach parts of Wikipedia on Wednesday.
Why it matters
Wiz estimates that PHP powers roughly 70% of websites worldwide. Not every PHP site is necessarily vulnerable, but the language’s reach has raised concern about how large the attacks could become.
The two flaws (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution and carry a severity score of 9.2. In plain terms, an attacker could run their own code on a vulnerable server without logging in. The bugs, collectively called PHP2Shell, could also let attackers read server memory, which may hold sensitive data such as passwords.
Discovered with AI
The flaws were uncovered and addressed by teams at OpenAI, Google-owned Wiz, and the security firm Calif. The AP described it as an AI-assisted discovery. That is a sign of how quickly AI tools are changing both vulnerability research and the pace defenders must keep up with.
The official response
The PHP team released emergency security updates on October 21. The FBI’s cyber division warned that the flaws could allow remote code execution, and advised operators to take websites offline if they couldn’t update immediately. The US National Security Agency and Europe’s cybersecurity agency also urged companies to act at once. Japan’s Prime Minister Sanae Takaichi urged organisations and individuals to check whether their public websites use PHP.
The wider-attacks worry
Amazon detected attempts to exploit the flaws before they were made public, and it remains unclear how attackers learned of them. That is why the concern now is a wider wave of attacks, particularly against sites that haven’t patched.
What website owners should do
- Check whether your site runs PHP. This includes WordPress and many other popular platforms.
- Apply the latest PHP security release from your host or developer as soon as possible.
- If you can’t update yet, consider taking the site offline temporarily, as the FBI advised.
- Ask your hosting provider whether they’ve patched, and review your server logs for unusual activity.
The bottom line
Many government sites were working normally again by Thursday, but outages and limited services continued while security work was under way. The biggest risk now is unpatched sites that attackers can find and target.
Leave a Reply