Government websites go offline worldwide after critical PHP vulnerabilities are disclosed

Government websites and public agency portals around the world went offline on October 21 following the disclosure of two critical vulnerabilities in PHP, a programming language that reportedly powers approximately 70% of websites worldwide.

The U.S. National Security Agency (NSA) urged organizations using PHP to prepare for emergency updates and disconnect affected systems if they could not immediately install the fixes. The agency warned that the flaws could provide attackers with a direct path to server file systems or databases.

PHP developers released four patches to address the two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both received severity scores of 9.2 out of 10 under the CVSS 4.0 system.

The flaws affect how PHP handles server memory and could potentially allow attackers to execute code remotely without requiring a password or user account.

The vulnerabilities were discovered by cybersecurity firm Calif using OpenAI’s GPT-5.6 model, according to the reports, and independently by cybersecurity company Wiz as part of the Patch the Planet initiative.

The PHP Foundation acknowledged that a researcher had identified early indications of one of the vulnerabilities in 2024. However, the issue remained theoretical at the time, and no concrete exploitation methods were identified. The foundation described the delay in addressing the problem as a “structural failure,” Reuters reported.

Government services disconnected as a precaution

Several European countries took government websites and public services offline before patches became available.

In the Netherlands, the National Cyber Security Centre and several organizations disabled their online portals. Affected services reportedly included the Port of Rotterdam, the Overheid.nl government portal, the Royal Dutch Football Association (KNVB) and hospitals.

In Finland, the state-owned service provider Valtori disconnected public-facing government network services as a precaution.

Meanwhile, Denmark’s municipal technology company Kombit shut down several services, including the country’s national school communication platform.

CERT-EU, the European Union’s cybersecurity technical advisory body, recommended that organizations consider isolating internet-facing applications from public networks until a solution became available.

Security experts warn of active exploitation

Cybersecurity platform Patchstack reported receiving information about active exploitation attempts. Cloudflare, an internet infrastructure and security provider, also reported signs of attacks and said it was updating its protective measures as new attack methods emerged.

Cloudflare Chief Technology Officer Dane Knecht said early attacks were appearing and that the company was updating its mitigations as new exploitation techniques emerged.

Security experts also warned that attackers could use artificial intelligence to analyze the released patches and quickly develop exploit scripts.

“Some guy on Twitter could take the patches and run AI against them and publish some exploit script. Hell will break loose,” Calif Chief Executive Thai Duong told The Wall Street Journal.

PHP is widely used to power content management systems and online platforms. WordPress, which relies on PHP, accounts for approximately 43% of all websites, while other platforms using the language include Drupal, Joomla and Magento.

Wordfence, a security provider for WordPress, warned that the platform’s usual automatic updates would not apply the PHP vulnerability fixes, meaning administrators would need to ensure that the underlying PHP installations were properly updated.

The incident highlights the risks posed by widely used software vulnerabilities and the importance of applying security patches promptly, particularly for government systems and other services exposed to the internet.

Sources: Reuters, the U.S. National Security Agency, the PHP Foundation, CERT-EU, Cloudflare and The Wall Street Journal.