Government websites go dark after AI-discovered flaw sparks security scramble
Security officials said the flaws rate 9.2 out of 10 and could allow unauthenticated remote code execution on vulnerable servers.
- On Wednesday, October 21, 2026, PHP developers released emergency security updates addressing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, urging administrators to apply fixes immediately.
- Leaked vulnerability details forced the PHP security team to accelerate the release by one day after researchers reported proof-of-concept exploits circulating before official fixes were available.
- Rated 9.2 on the CVSS v4.0 severity scale, the flaws allow unauthenticated remote code execution, enabling attackers to run malicious code on vulnerable servers without credentials.
- Government agencies in the Netherlands and Finland took public-facing websites offline as a precautionary measure, following cybersecurity officials' guidance that unpatched systems face severe intrusion risks.
- Administrators must install patches manually, as automatic platform updates do not apply the fix; older, unsupported PHP versions require specific remediation to ensure system integrity.
334 Articles
334 Articles
It's 'One of the Most Impactful Security Issues in Recent Memory'
Some websites went offline intentionally on Wednesday following a newly disclosed set of vulnerabilities in what NBC News descriptions as "a little-known but crucial programming language which powers how web servers process code." Per W3Techs , PHP is used in 69% of all websites. The two laws were serious enough that...
The Korea Times
Vanguard NewsWASHINGTON — Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. The U.S. National Security Agency told organizations to patch immediately or pull vulnerable systems offline. The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement on X. A…
A newly discovered, serious security vulnerability currently threatens several million websites and online services worldwide. Among them news portals, but also pages of the country and municipalities and public institutions. Background is the widespread programming language PHP. On this basis, a large part of the Internet is based. According to the IT security company Huntress, the computer emergency response team of the federal government (Cer…
The websites of all prefectures have been inaccessible since Wednesday afternoon, at the request of the Anssi. This follows the "detection of a critical security vulnerability", explained the Ministry of the Interior. Other websites, in France and around the world, are also affected by this global security flaw. - "Critical vulnerability": The prefectures' websites made inaccessible by a global security flaw (New Technologies).
70 percent of the world's businesses may be affected by serious vulnerability
Coverage Details
Bias Distribution
- 36% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
