Government agencies, media platforms, and critical services across Europe and beyond took websites offline on Wednesday after researchers disclosed two critical vulnerabilities in PHP, a programming language used by roughly 70% of the world’s websites. The flaws, designated CVE-2026-109618 and CVE-2026-109619 with a 9.2 severity rating, allow unauthenticated remote code execution, potentially granting attackers control over server file systems and databases.
The PHP Foundation released emergency patches on Wednesday afternoon, but details of the vulnerabilities leaked on social media a day earlier, forcing an accelerated response. OpenAI confirmed that its GPT-5.6 Sol model, used in the *Patch the Planet* initiative, helped uncover one of the flaws, while researchers at Wiz independently identified both. The vulnerabilities had evaded detection for over a decade, according to Wiz, which called them the “most severe vulnerabilities ever discovered” by AI .
National cybersecurity agencies, including the U.S. NSA, the UK’s NCSC, and Germany’s BSI, urged organizations to apply the patches immediately or take systems offline if updates could not be installed in time. The NSA warned that the flaws could provide “a direct path to the server’s file system or database” . Finland shut down its government’s public web services, while the Netherlands’ National Cyber Security Agency and the lower house of parliament, the Tweede Kamer, took their sites offline. In France, the Paris police prefecture’s website and other local administration pages went dark. The Wikimedia Foundation preemptively disabled several systems, temporarily cutting access to parts of Wikipedia .
Cloudflare reported a surge in exploit attempts following the disclosure. CEO Matthew Prince said the company observed thousands of attempts in the 10 hours before the public announcement, escalating to millions within hours . Security researchers at Wiz noted that the flaws, though long-standing, required an “exceptionally complex chain of steps” to exploit, but warned that the gap between vulnerability and exploitation was rapidly closing .
By Thursday, some sites remained offline, including Dutch services such as *Meld Misdaad Anoniem* and local branches of *Veilig Thuis*, as administrators worked to apply the fixes . The PHP Foundation acknowledged that the flaws had been known for years but cited a lack of specialists and the complexity of solutions for the delay in patching .
