Geneva: Government websites and major online platforms went offline on October 21 as cybersecurity teams rushed to address critical vulnerabilities in PHP, a widely used programming language, following an AI-assisted discovery that triggered an international security alert.
PHP developers released emergency updates on October 21 to fix two critical vulnerabilities that could allow attackers to execute malicious code remotely without authentication. The development team urged users to install the patches immediately, while cybersecurity agencies advised organizations to consider taking affected systems offline if they could not apply fixes promptly.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose risks to servers running PHP-based applications. The language underpins a substantial share of the web and is used by platforms including WordPress, Drupal and Joomla, potentially exposing a broad range of websites and online services to attack.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
— NSA Cyber (@NSACyber) October 21, 2026
Cybersecurity agencies across Europe and elsewhere called on organizations to identify affected systems, prioritize internet-facing servers and install the relevant updates. The UK’s National Cyber Security Centre also recommended monitoring systems for suspicious activity and checking third-party products that may include PHP.
Several organizations responded by temporarily taking systems offline. The Dutch cybersecurity agency confirmed it had gone offline as a precaution, while Wikipedia’s operator and the Internet Archive also reported taking systems offline while addressing the vulnerabilities.
The public release of patches has heightened concerns that attackers could quickly develop ways to exploit systems that remain unprotected. Security experts warned that website operators face a race to update vulnerable infrastructure before intrusions spread. Organizations using PHP have been urged to check their software versions and apply the appropriate security fixes without delay.
IMPORTANT | Nigeria detects first Ebola case as outbreak spreads across Africa
