Governments take websites offline as critical PHP flaws prompt urgent patching
publishers 62articles 75first reported 21 Oct, 02:12 UTCdeveloping since 21 Oct · 11 editionstop 25 #5
Government agencies and businesses took websites and online services offline this week while installing emergency fixes for two critical vulnerabilities in PHP, the server-side programming language used by nearly 70% of websites whose underlying language is known.
The flaws, dubbed “PHP2Shell” and identified as CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated attacker to execute code remotely on vulnerable servers. Potential consequences include data theft, website defacement and broader system compromise. Researchers said the weaknesses had remained in PHP for more than a decade before teams using artificial intelligence tools identified workable attack paths.
The PHP Foundation released patched versions — 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — on Wednesday. Cybersecurity authorities advised operators to update immediately and temporarily disconnect systems that could not be patched. Updating website themes or plugins alone does not address the underlying PHP vulnerabilities.
Public services were disrupted across Europe. The Netherlands took down government portals and its DigiD identity service, while Finland, France, Germany and the United Kingdom restricted or disabled some services as precautions. Britain reported 32 government services unavailable and four partially unavailable, while saying no major public-facing critical services were affected. Ghana gave government institutions seven days to identify and remediate vulnerable systems.
Reports differed on exploitation activity. The PHP Foundation said Wednesday that it had no evidence of a successful working exploit, and British officials reported no known breaches. Amazon Threat Intelligence reported observing an exploit attempt, while security researchers said they had reproduced a working exploit. Authorities urged organizations to inspect logs and systems for signs of compromise after patching.
HOW THIS STORY WAS MADE
Written from 8 articles, 6 with the publisher's own text; 8 independent newsrooms once syndicated copies count as one; this version written 36 h after the record first saw the story; the editor kept it as written.
- Publishers
- 62
- Source articles
- 75
- Given to the writer
- 8, 6 with the article's own text
- Independent newsrooms
- 8
- This version written
- 36 h after the record first saw the story
- Second model (editor)
- kept as written
- Publication gate
- passed
- Human review
- none
WHAT THE EDITOR DID
The second model checked the writer's draft against the same sources and published it as written.
Written by a language model from the sources above, then checked by a second model that may only cut, attribute or correct. How it works →