Government websites, media platforms and critical services across Europe and beyond went offline Wednesday after researchers uncovered two critical vulnerabilities in PHP, the server-side programming language underpinning roughly 75% of all websites with an identifiable backend.
The PHP Foundation released emergency patches for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 at 13:34 UTC, warning that the flaws—rated 9.2 out of 10 on the CVSS scale—allow unauthenticated remote code execution, giving attackers direct access to server file systems and databases . Security firms Wiz and Calif identified the vulnerabilities using OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, coordinating with PHP maintainers before disclosure .
National cybersecurity agencies, including the U.S. NSA, UK NCSC and EU’s CERT-EU, urged immediate patching or takedowns of affected systems. The NSA stated the flaws “provide a direct path to the server’s file system or database” and recommended disconnecting vulnerable systems if updates could not be applied .
In response, authorities in the Netherlands took down the National Cyber Security Centre’s site, the Port of Rotterdam’s portal, the Tweede Kamer (parliament) website and several hospitals . France’s Interior Ministry placed its sites into preventive maintenance, while Denmark’s Kombit shut down municipal IT services, including a national school communication platform . The Wikimedia Foundation confirmed it had taken multiple systems offline as a precaution .
The vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, affect every PHP release dating back to 2004, including versions used by WordPress, Drupal, Joomla and Magento . PHP Foundation acknowledged one flaw was first detected in 2024 but said patching was delayed by resource constraints and complexity, with the full scope clarified only after AI-assisted analysis .
Cloudflare’s CTO reported early exploitation attempts, while Censys data indicated approximately 1.5 million of 2.6 million internet-facing hosts run unpatched PHP versions . Japan’s Prime Minister Sanae Takaichi urged website operators to verify PHP usage and prepare for updates .
