21-10-2026
International governments and cyber-security agencies have urged organisations to patch two critical vulnerabilities in PHP, a programming language used by a large part of the internet. The PHP Foundation issued fixes on Wednesday after details of the flaws leaked online, forcing it to announce the vulnerabilities earlier than planned. Agencies advised organisations unable to apply the fixes promptly to take affected systems offline. Finland shut down public government web services, the Netherlands took cyber-security and government sites offline, and the US National Security Agency issued similar advice. The Wikimedia Foundation said it had taken some systems offline as a precaution, while some Wikipedia services became inaccessible. Edinburgh council and several BBC programme websites were also unavailable, though the BBC said it had not confirmed a connection to PHP. Other sites reported maintenance outages without explaining their causes.
Researchers at cyber-security firms Calif and Wiz discovered the flaws through OpenAI’s Patch the Planet program, which provided access to advanced AI tools. The vulnerabilities had reportedly gone undetected for more than a decade. Wiz estimated that roughly 70% of the internet could be affected, although the BBC could not verify that figure. OpenAI described the discovery as one of the most impactful security issues in recent memory. Researchers said AI tools helped them develop and adapt working exploits across applications in hours.
Authorities in the UK, EU, Australia and Japan also urged PHP users to install the updates. Experts warned that the vulnerabilities could enable unauthenticated remote code execution, potentially allowing attackers to install malware or disrupt websites. They said organisations must identify every place PHP is running, including within third-party products, and monitor for signs that attackers may already have gained access. The affected versions are not yet fully clear; CERT-EU said the flaws could reach back to PHP 5, while the PHP Foundation issued updates only for newer releases and urged users of PHP 8.1 or older to upgrade. PHP runs on servers and underpins platforms including WordPress, Drupal, Joomla and Magento.
Entities: PHP vulnerabilities, PHP Foundation, OpenAI Patch the Planet, Wiz, Calif • Tone: urgent • Sentiment: negative • Intent: inform
21-10-2026
PHP developers released patches for two critical security vulnerabilities after details of the flaws leaked ahead of schedule and security firms reported early attempts to exploit them. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to remotely take control of websites and servers, bypassing protections such as password-protected accounts. Potential consequences include access to government databases and customer information, website defacement, and compromise of businesses and online services. PHP is a free, widely used programming language that supports millions of websites, including government portals, critical infrastructure, news sites, and online shops. The PHP team and the PHP Foundation urged users to install the updates immediately. Security companies Calif and Wiz identified the flaws using AI tools and kept them confidential while developers prepared a fix. However, the issues became public on Tuesday, a day before the planned update. Cloudflare CTO Dane Knecht said the company was seeing early attacks and adjusting its mitigations. The Wikimedia Foundation said it was addressing the vulnerabilities and had taken some systems offline until they could be safely patched. Government and cybersecurity authorities in several countries—including Australia, Japan, France, Germany, Belgium, and the Netherlands—issued warnings or temporarily took websites offline as a precaution. The US National Security Agency advised organizations to take affected systems offline if an immediate update was not possible, noting that the flaws could provide direct access to server files or databases. The White House said federal agencies were assessing the potential impact on government systems and infrastructure.
Entities: PHP, PHP Foundation, CVE-2026-109618, CVE-2026-109619, Dane Knecht • Tone: urgent • Sentiment: negative • Intent: warn
21-10-2026
The Canadian government is temporarily taking some of its websites offline while it applies security updates for vulnerabilities in PHP, a widely used programming language that underpins an estimated 70 per cent of the world’s websites. The flaws could allow attackers to steal information, deface websites or take them over if the affected software is not patched. Developers have already released a fix, but the vulnerabilities prompted concern across the cybersecurity community and led governments and businesses to take precautionary measures.
AI Minister Evan Solomon said the government acted on advice from the Communications Security Establishment’s Canadian Centre for Cyber Security. He described the issue as global and urged organizations using PHP to apply the latest security updates and follow the Cyber Centre for further guidance. Affected government websites are expected to return once patches have been applied.
The Cyber Centre’s guidance advises organizations to patch PHP installations immediately, check and update third-party products that rely on PHP, and take internet-facing applications offline if a fix cannot be applied right away. The article says the Treasury Board had not immediately answered questions about how many government websites were affected or what specific steps were being taken. The report does not provide a count of affected sites or identify when individual websites will be restored.
Entities: Ottawa, Government of Canada, Alex Boutilier, Evan Solomon, Communications Security Establishment (CSE) • Tone: urgent • Sentiment: neutral • Intent: inform
21-10-2026
Government websites in Europe and elsewhere went offline on Wednesday after developers disclosed two critical vulnerabilities in PHP, a programming language used by a large share of the internet. PHP’s developers announced the flaws on Tuesday and urged users to update their systems as soon as a fix became available. Reports that attackers were already exploiting the vulnerabilities prompted some organizations to take precautionary action before patches were ready.
Government agencies in the Netherlands and Finland were among those that took websites offline. The Dutch cybersecurity agency also temporarily shut its own website, explaining that the move was precautionary. Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take affected websites offline until they could apply patches.
The risks extend widely because PHP supports platforms and services including WordPress, Drupal, Joomla and Magento, as well as hosting systems and other software that may not make its use apparent. Huntress described PHP as pervasive, while Wordfence noted that all WordPress sites run on servers with PHP installed. It also warned that automatic WordPress updates would not install the necessary PHP fix, leaving site owners to determine who manages PHP updates for their sites.
Cloudflare’s chief technology officer, Dane Knecht, said the company was seeing early attacks and was updating firewall rules to mitigate emerging attack methods. He stressed that these measures were only a stopgap and that users should patch as soon as an update became available. Officials said all PHP versions from version 5 onward could be affected, although PHP had not yet specified which versions were vulnerable. The article reports that operators faced an immediate choice between applying a forthcoming patch and taking sites offline to reduce exposure.
Entities: PHP, Netherlands, Finland, Europe, Australia • Tone: urgent • Sentiment: negative • Intent: inform
