EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities
CERT-EU said the flaws could enable unauthenticated remote code execution, and organizations unable to patch immediately should take affected sites offline.
- On Wednesday, October 21, 2026, the PHP development team will release patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC. Each flaw is rated 9.2 on the CVSS v4.0 severity scale.
- Following unauthorized information leaks, the PHP security team moved the patch release forward by one day. The vulnerabilities allow unauthenticated attackers to run malicious code on servers without credentials, creating immediate risk.
- The European Union Computer Emergency Response Team and the Australian Cyber Security Centre issued advisories urging organizations to identify PHP systems and apply updates immediately. Where immediate patching is not feasible, officials recommended taking affected internet-facing sites offline.
- Organizations including the Dutch government took sites offline as a precaution, while Cloudflare reported intercepting early attacks. Cybersecurity firm Huntress noted that PHP's widespread use across WordPress, Drupal, Joomla, and Magento creates a massive attack surface.
- While authorities report no confirmed widespread exploitation, administrators are encouraged to monitor environments for malicious activity. The PHP developers warned they would "release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
94 Articles
94 Articles
The programming language PHP probably knows only a few people, but its global significance is enormous. Hackers are currently trying to exploit vulnerabilities. Developers are announcing an update.
Two critical vulnerabilities in the PHP programming language endanger numerous websites worldwide. Hackers are already exploiting the vulnerabilities. Experts recommend an immediate software update.
A critical PHP vulnerability may take websites down today
Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of […]
Follow all the news here about the problem with the PHP programming language that has caused many websites to be taken offline as a precaution.
Coverage Details
Bias Distribution
- 42% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
