Governments and major organisations across Europe and beyond have pulled their websites offline this week after researchers disclosed a pair of critical flaws in PHP, the scripting language that underpins much of the internet, sending operators racing to apply a fix.
The two issues, catalogued as CVE-2026-109618 and CVE-2026-109619, can let an attacker trigger an out-of-memory condition in PHP that results in memory corruption. That corruption, under certain conditions, can be exploited to achieve unauthenticated remote code execution, handing hackers what the US National Security Agency described as “a direct path to the server’s file system or database.”
Disclosure came on Tuesday, with PHP developers releasing a security update on Wednesday afternoon. By then the fallout was already wide. Among the bodies that took pages down were the Finnish government, which suspended its public web services, the Netherlands’ cyber-security agency, Edinburgh council and the BBC, whose programme sites for Doctor Who and The Traitors went dark. The Wikimedia Foundation said it had taken down a number of systems as a precaution, briefly cutting off access to parts of Wikipedia.
The weakness reaches deep into everyday infrastructure. According to cyber-security firm Huntress, PHP quietly runs WordPress, Drupal, Joomla and Magento sites, along with shared hosting platforms and control panels, frequently without the organisations relying on it being aware. Officials warned that all PHP versions from PHP 5 onward could be affected.
Sponsored · Selkirk Copper Mines
Credit for finding the flaws goes to researchers at Calif and Wiz, who used state-of-the-art AI built by OpenAI. Wiz called them the “most severe vulnerabilities ever discovered” by the technology, estimated that “roughly 70%” of the internet is affected, and said they had lurked undetected for more than a decade.
Cyber-security agencies in the UK, EU, Australia and Japan have told PHP users to update immediately or take systems offline until mitigations can be applied. Cloudflare chief technology officer Dane Knecht said the firm was “seeing early attacks emerging and are updating mitigations as new vectors show up.”
