PHP Security Vulnerabilities Explained: Why Are Websites Being Taken Down Worldwide?

Government portals, public broadcasters and community platforms went offline after two critical flaws were disclosed in PHP, one of the most widely used programming languages on the web. Agencies in several countries have told organisations that cannot patch immediately to consider switching their sites off until they can.

What is PHP and why does it matter?

PHP is a scripting language that runs on web servers and generates the pages a visitor sees. According to security firm Huntress, it sits quietly beneath platforms such as WordPress, Drupal, Joomla and Magento, as well as shared hosting services, control panels and software that never mentions PHP at all. Security firm Wiz has estimated that roughly 70 percent of the internet is affected.

What are the flaws?

The PHP project published an advisory on 21 October covering two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 on the CVSS v4.0 severity scale. Each can allow remote code execution without authentication, meaning an attacker could run commands on a server without logging in. EU cyber-security body CERT-EU said the risk scores point to exactly that possibility.

The first flaw involves how PHP handles running out of memory. According to the advisory, PHP can be interrupted while internal request data is only partly set up, and the clean-up that follows may treat that incomplete data as valid. The second involves leftover internal state. Data tied to one request can outlive the memory behind it, and a later request handled by the same worker process may use that stale data before PHP resets it.

PHP says the risk is highest on servers using Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any of a site's own code runs. All PHP installations that serve web requests are listed as affected. The US National Security Agency said flaws of this kind often give attackers a direct route to a server's file system or database.

How the flaws came to light

The vulnerabilities went undetected for more than a decade. Researchers at cyber-security firms Calif and Wiz found them using advanced AI tools, and Wiz called them the most severe vulnerabilities AI has ever uncovered. Calif and the PHP Foundation were part of Patch the Planet, a programme run by OpenAI that gave them access to its AI tools to find and fix flaws in web development software. OpenAI described the discovery as one of the most impactful security issues in recent memory, and said one of its own researchers independently found the problem around the same time. Wiz said frontier AI models let its team build working exploits across multiple applications within hours.

The PHP Foundation had planned to disclose the flaws later this month alongside a full fix. Details leaked on social media on Tuesday, the BBC reported. The project had already warned on 20 October of an imminent critical release, reserving the right to publish early if details became public. It released the patches on Wednesday.

Why sites are going offline?

Patching is harder than it sounds. Security expert Don Smith of Sophos told the BBC that the immediate challenge is finding every place PHP runs, since it can sit under public sites, content management systems, hosting platforms and third-party products without the organisation realising. Until each instance is updated, taking a site offline is the only certain way to block an attack.

The UK's National Cyber Security Centre said organisations that cannot fix the problem immediately should consider taking the affected system offline. Japan's national cyber-security office and EU officials issued similar warnings. Finland temporarily shut its government's public web services, and the Netherlands' cyber-security agency took its own website down. A Dutch public health agency and the Dutch parliament's lower house also became inaccessible. The Wikimedia Foundation said it had taken a number of systems offline as a precaution, which left parts of Wikipedia unreachable. Edinburgh council's website and pages for BBC programmes including Doctor Who and The Traitors also went down, though neither has confirmed a PHP link. DeviantArt said only that it was down for maintenance.

Cloudflare's chief technology officer, Dane Knecht, said the company was already seeing early attacks and updating its protections as new methods appeared. Japanese Prime Minister Sanae Takaichi urged people to check whether their public websites run on PHP, and the White House said federal agencies were working with leading AI labs to speed up a fix.

What India’s cyber agency has said

India’s national cyber-security agency, CERT-In, issued a vulnerability note on 21 October, the same day PHP released its patches, and rated it critical. The note, numbered CIVN-2026-0510, warns that multiple flaws in PHP could let a remote attacker run arbitrary code on a targeted system. CERT-In says the risk is high, with a possibility of complete system compromise, and addresses the warning to all organisations and individuals using PHP. It attributes the problem to memory corruption and improper resource control, and says an attacker could exploit it by sending a specially crafted request to a system. The note lists PHP 8.5 versions before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35 as affected, and directs users to apply the updates and mitigations in PHP’s own advisory. It does not mention older PHP versions, and it does not report any Indian websites being taken offline.

What the fix covers

PHP has released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions and long-term-support vendors received the patches in advance, so administrators should check their vendor for updated packages. The project says PHP 8.1 and older no longer get official updates, though some vendors offer backported fixes. It has also published source-code patches for PHP 7.4, 8.0 and 8.1 for those who build from source. CERT-EU said the flaws may reach back to PHP 5, released in 2004.

The PHP project says only an update fully protects a server. It lists interim configuration changes, such as limiting request sizes and disabling certain settings, but says these cut exposure to specific attack paths without making an installation safe. The NCSC advised organisations to keep monitoring for updates from vendors whose products bundle PHP.

Published on: Thursday, October 22, 2026, 09:14 AM IST