Critical PHP Security Flaws Put Websites Around the World on Alert
Websites worldwide have been scrambling to protect themselves against potentially serious cyberattacks after critical vulnerabilities were discovered in PHP, one of the internet’s widely used programming languages.
PHP has released emergency security patches to address the flaws. Still, the issue has already caused disruption, with organisations taking websites and individual pages offline while they apply the necessary updates.
What is PHP?
PHP, or PHP: Hypertext Preprocessor, is one of the most widely used programming languages for websites and web applications. It plays a fundamental role in delivering dynamic web content by gathering the information a user requests and presenting it in a format that can be viewed online.
The technology has been around for decades and is so deeply embedded in the web that it’s easy to overlook. But vulnerabilities in foundational technologies such as PHP can have consequences far beyond a single website.
That is particularly true when the vulnerabilities involve remote code execution, potentially giving attackers a route to run malicious code on vulnerable systems.
What happened?
Despite the alarming headlines, no confirmed reports show that companies or websites have been successfully hacked as a direct result of these PHP vulnerabilities.
Instead, organisations worldwide have taken precautionary measures. Some have temporarily taken individual pages or entire websites offline while they install the security patches released by PHP.
Government websites in Scotland and the Netherlands have experienced outages, while a Danish IT company that provides a school communications platform has also been affected.
Wikipedia and Wikimedia, its associated content-storage platform, also experienced outages, although both services appear to be back online.
PHP security fixes are available — patch now
The good news is that PHP has released emergency fixes for the vulnerabilities.
The issues have been identified as CVE-2026-109618 and CVE-2026-109619. The first involves an out-of-memory handling bug, while the second is a use-after-free memory error.
Both vulnerabilities have received a critical severity rating of 9.2 out of 10.
The flaws have been addressed in the following PHP releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Organisations running PHP should prioritise applying the appropriate update as quickly as possible.
Businesses have a “finite window” to respond
For security teams, the incident highlights how quickly organisations must respond when a critical vulnerability is discovered in widely deployed software.
“This is a stake-in-the-ground moment for CISOs around the world”, said Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.
He warned that organisations have only a limited window to strengthen their defences before attackers begin exploiting newly disclosed vulnerabilities.
The message is clear: organisations need to understand their attack surface, patch vulnerable systems quickly and minimise the potential impact if an attacker does gain access.
Who has been affected?
The scale of the PHP vulnerability makes it difficult to identify every organisation that could potentially be affected. Some reports suggest PHP could underpin around 70% of websites, although actual exposure will vary depending on how PHP is deployed and which versions organisations run.
Several European governments have already taken precautionary action.
According to Reuters, affected organisations and services have included:
- Germany: The country’s ministry said federal IT service provider ITZBund had taken several websites offline after PHP vulnerabilities were discovered. The shutdown was described as a purely preventive measure.
- France: The Interior Ministry temporarily took the websites of local government administrative offices offline while waiting for the PHP patches.
- Belgium: The Foreign Ministry temporarily took its websites offline following reports of attacks exploiting the PHP vulnerabilities, although those reports were not confirmed.
- The Netherlands: The National Cyber Security Centre took public-facing websites offline, along with sites belonging to the Port of Rotterdam, the Dutch national football association KNVB, the country’s largest political parties and numerous hospitals.
Most of these services have since returned online.
AI played a role in discovering the vulnerabilities
One of the more interesting aspects of the PHP incident is the role artificial intelligence played in identifying the vulnerabilities.
Ryan Austin, a researcher at cybersecurity firm Calif who was involved in uncovering the PHP flaw, has acknowledged the contribution of OpenAI systems to the discovery process.
Calif’s researchers had identified potential PHP flaws as far back as 2024, but the work was not accepted into OpenAI’s Planet initiative until July 2026. The program uses advanced AI systems to help identify and address cybersecurity vulnerabilities.
In August 2026, Calif discovered a more serious PHP issue. OpenAI also identified the vulnerability, helping researchers and maintainers work toward a fix.
OpenAI said the effort had brought together maintainers, researchers and security providers to address critical vulnerabilities in PHP.
The incident also illustrates AI’s double-edged nature in cybersecurity. The same technology that can help defenders uncover vulnerabilities at internet scale could potentially help attackers develop exploits more quickly.
The supply-chain risk could be significant.
The PHP vulnerabilities also demonstrate how a weakness in widely used open-source software can ripple through interconnected industries.
If one organisation is forced to take critical systems offline, the consequences can extend to customers, suppliers and partners that depend on those systems.
Chris Dimitriadis, Chief Global Strategy Officer at ISACA, described the situation as a reminder that the global economy increasingly depends on complex and interconnected digital infrastructure.
The bigger question, however, is whether organisations are prepared to respond when vulnerabilities emerge.
Cyber resilience cannot simply be switched on during a crisis. Businesses need to understand where they are exposed, know which technologies they depend on and have the people, processes and controls required to respond quickly.
Some UK government services affected.
The UK government has also acknowledged that some limited government services may be offline while security work is carried out.
The BBC reported that no major UK public-facing critical services had been affected, although officials were working to identify and address potential exposure across government systems.
The UK government is also working closely with OpenAI and international partners as part of its response.
What should small businesses do?
While major government agencies and large technology companies tend to attract the headlines, smaller businesses could feel the impact particularly sharply.
For an SMB, even a few hours of website downtime can translate directly into lost sales and disrupted operations.
If you run a small business, take these steps immediately.
Contact your website host.
If an external provider hosts your website, contact them to establish whether your site uses PHP, whether it is running an affected version and what steps are being taken to address the vulnerability.
Back up your website
Make sure you have a recent, reliable backup of your website and its associated data.
Just as importantly, check that the backup can actually be restored. A backup that cannot be recovered quickly is of limited use during an incident.
Stay alert for scams.
High-profile security incidents often create opportunities for cybercriminals and scammers.
Be particularly cautious of unexpected emails, messages or calls claiming that your website has been compromised or asking you to install software, provide credentials or make payments.
Attackers can exploit the uncertainty surrounding a major vulnerability just as effectively as they can exploit the vulnerability itself.
What should larger organisations do?
Larger businesses should take a broader approach that goes beyond simply applying the latest patch.
Kara Sprague, CEO of HackerOne, recommends strengthening vulnerability disclosure processes and using automation to validate, deduplicate, and prioritise security findings based on the criticality of the affected assets and their potential impact.
Organisations should also use information from security researchers to determine which vulnerabilities require the most urgent attention.
And patching should not be treated as a one-time exercise.
Large enterprises may have forgotten or overlooked PHP installations that remain vulnerable after an initial remediation effort. Once the first round of patching is complete, organisations should keep looking for exposed systems and consider using existing bug bounty programs to uncover vulnerabilities they may have missed.
The key lesson is simple: finding vulnerabilities before attackers do is valuable only if organisations can act quickly enough to fix them.
The bigger lesson from the PHP vulnerabilities
The PHP incident reminds us how interconnected the modern internet has become.
A vulnerability in a piece of open-source software used across millions of websites can potentially create consequences for governments, businesses and consumers around the world.
The immediate priority is to identify vulnerable systems and apply the available patches. But the longer-term challenge is building the resilience needed to respond to the next major vulnerability — because there will be another one.
AI may increasingly help security researchers find these weaknesses faster than ever before. The challenge for organisations is ensuring their defensive capabilities can keep pace.
The key takeaways
Here’s what businesses need to know:
- Organisations worldwide are patching websites that rely on vulnerable versions of PHP.
- The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been rated critical, with a severity score of 9.2/10.
- PHP has released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- No confirmed reports of successful cyberattacks exploiting the vulnerabilities, but many organisations have taken systems offline as a precaution.
- Government websites and Wikipedia were among the high-profile services affected.
- Some UK government services may also have experienced limited disruption.
- Businesses should check whether they are running an affected PHP version, contact their hosting provider where appropriate and ensure reliable backups are available.
- Organisations should stay alert for phishing and other scams that may exploit the publicity around the incident.
- The incident highlights both the defensive potential and offensive risks of AI-powered cybersecurity.
For now, the message for organisations running PHP is straightforward: find vulnerable systems, patch them quickly and don’t assume the job is finished once the first update has been applied.