Government websites go dark after AI-discovered flaw sparks security scramble
The flaws rate 9.2 on CVSS v4.0 and could let attackers run code on vulnerable servers without logging in, officials said.
- On Wednesday, October 21, 2026, PHP developers released emergency security updates addressing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, urging administrators to apply fixes immediately.
- Leaked vulnerability details forced the PHP security team to accelerate the release by one day after researchers reported proof-of-concept exploits circulating before official fixes were available.
- Rated 9.2 on the CVSS v4.0 severity scale, the flaws allow unauthenticated remote code execution, enabling attackers to run malicious code on vulnerable servers without credentials.
- Government agencies in the Netherlands and Finland took public-facing websites offline as a precautionary measure, following cybersecurity officials' guidance that unpatched systems face severe intrusion risks.
- Administrators must install patches manually, as automatic platform updates do not apply the fix; older, unsupported PHP versions require specific remediation to ensure system integrity.
367 Articles
367 Articles
PHP developers say key patches available after global scare
The updates patching the recently leaked PHP security issues are now online, developers of the open-source programming language said on Wednesday afternoon. "All PHP users are strongly encouraged to update immediately," the team said in an online statement. Millions of websites worldwide, including critical infrastructure and government portals, as well as news sites and online shops, rely on PHP. The software is free and maintained by volunteer…
Government websites are being massively disabled in Europe due to the threat of hacking
Government websites are being massively disabled in Europe due to the threat of hacking. Two vulnerabilities were found in the PHP programming language — it is used to create pages.They potentially open access to millions of servers...
TVA Nouvelles
24 heuresA critical vulnerability of the PHP tool ensures that many websites are inaccessible Tuesday noon in order to correct this flaw.
Governments and cybersecurity agencies around the world warn of the need to immediately update the systems of millions of websites that could be compromised by multiple critical bugs in PHP language detected by the company Wiz
Coverage Details
Bias Distribution
- 36% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
