Websites Go Offline Due to PHP Vulnerabilities as Security Risks Grow
Critical vulnerabilities in PHP have led numerous websites to go offline as organizations scramble to implement fixes amid growing cybersecurity concerns.
Multiple websites were taken offline on Wednesday in response to urgent security warnings regarding two serious vulnerabilities in the PHP programming language. The PHP maintainers reported these flaws, with a severity score of 9.2 out of 10, allowing for potential remote code execution.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, prompted a rapid global response. The PHP security team urged users to prepare for an upgrade immediately following the release of patches on Wednesday morning. As a precaution, various government agencies and organizations, including those in Finland and the Netherlands, disabled their public web services.
Dane Knecht, Chief Technology Officer at Cloudflare, stated that they are already witnessing early attacks in the wild. He indicated that organizations should take immediate measures to protect themselves. Jake Knott, head of threat intelligence for watchTowr, noted that attacks exploiting these vulnerabilities could emerge quickly, stating, “Whilst nobody has been successful to date, we don’t expect that will last long.”
The vulnerabilities were discovered through a collaborative effort involving AI technologies under OpenAI’s “Patch the Planet” program, which enabled researchers at firms including Calif and Wiz to find these critical flaws. OpenAI mentioned that while its tools helped identify the issues, they could also assist attackers in exploiting them.
In response to the vulnerabilities, the U.S. National Security Agency and other international cybersecurity agencies issued urgent advisories for organizations to patch their systems. If unable to do so in time, they were advised to take their systems offline until security measures could be confirmed. This led to the Edinburgh council and the BBC taking their web services offline.
According to cybersecurity experts, the growing prevalence of PHP websites poses a unique challenge. Don Smith from Sophos emphasized the difficulty of identifying all instances of PHP in organizations’ systems. “The use of PHP is pervasive… sometimes without even being obvious,” he explained. Experts estimate that around 70% of all websites on the internet utilize PHP.
Despite patches being released, concerns remain about numerous sites still operating on outdated PHP versions that will not receive updates. Joviane Jardim, a senior security researcher at Detectify, said that many organizations may not even know where their PHP instances are located. He stated, “That’s the risk with this one: the flaws became public before the fix did…”
As organizations race to safeguard their systems, the risk remains high. The resolution of these vulnerabilities is critical, with potential repercussions for millions of websites that depend on PHP for their operation.
