EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
- On Wednesday, October 21, 2026, the PHP development team will release patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC. Each flaw is rated 9.2 on the CVSS v4.0 severity scale.
- Following unauthorized information leaks, the PHP security team moved the patch release forward by one day. The vulnerabilities allow unauthenticated attackers to run malicious code on servers without credentials, creating immediate risk.
- The European Union Computer Emergency Response Team and the Australian Cyber Security Centre issued advisories urging organizations to identify PHP systems and apply updates immediately. Where immediate patching is not feasible, officials recommended taking affected internet-facing sites offline.
- Organizations including the Dutch government took sites offline as a precaution, while Cloudflare reported intercepting early attacks. Cybersecurity firm Huntress noted that PHP's widespread use across WordPress, Drupal, Joomla, and Magento creates a massive attack surface.
- While authorities report no confirmed widespread exploitation, administrators are encouraged to monitor environments for malicious activity. The PHP developers warned they would "release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
136 Articles
136 Articles
A serious security vulnerability causes alarm tuning – and worldwide! PHP, one of the most frequently used programming languages in the world, is affected by numerous websites and online services. Several countries go precautionarily offline. The Vienna Uni servers have already been deactivated prophylactically.
Critical vulnerabilities were discovered in the PHP programming language, and the developers announced that they will release fixes. European Union cybersecurity officials warned that organisations unable to install updates immediately should temporarily shut down affected websites.
The script language PHP, which is widely used on the Internet, has serious vulnerabilities. This allows malicious programs to be executed remotely. A security update is still pending.
Coverage Details
Bias Distribution
- 40% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
