Technology·October 22, 2026·2 min read

Critical PHP flaws trigger global security scramble

Government and hospital websites taken offline as emergency patches roll out

By No Spin Media NewsroomPublished
Critical PHP flaws trigger global security scramble
AI neural network concept illustration.No Spin Media AI Illustration (generated with Gemini)

Two critical security vulnerabilities in PHP, one of the world's most widely used web programming languages, triggered an international cybersecurity response as governments and other organizations temporarily shut down websites while installing emergency fixes.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 under the CVSS 4.0 security scale. They can allow unauthenticated remote code execution, meaning an attacker could potentially run commands on a vulnerable server without first obtaining a password or account. PHP developers released security updates on October 21 and urged users to install them immediately. U.S. agencies including the FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency also urged organizations to patch affected systems or take them offline until they can be secured.

Government websites in Germany, France, Finland and the Netherlands were among services temporarily taken offline as a precaution. Other affected organizations included hospitals, the Port of Rotterdam and systems operated by the Wikimedia Foundation. Officials in several countries said the shutdowns were preventive and did not indicate that their systems had been breached. Security company Cloudflare reported seeing early attacks targeting the vulnerabilities, while U.S. officials said they had not confirmed widespread exploitation when their warnings were issued.

The flaws drew additional attention because artificial intelligence assisted researchers in finding them. Security researchers working with OpenAI reported one vulnerability to PHP developers in August, while Wiz independently identified another using AI-assisted security research. One underlying issue had first drawn attention in 2024, but PHP developers said its exploitability was not understood at the time. PHP later acknowledged that its handling of the earlier report exposed weaknesses in its security process.

PHP runs behind a large share of the world's websites, including sites built with platforms such as WordPress, making rapid installation of the newly released fixes particularly important.

Community discussion
"Does the discovery of vulnerabilities this serious show that AI could become as important for cyber defense as it is potentially dangerous for cyberattacks?"