UPDATE — October 21, 2026: PHP patches released as government websites go offline.
PHP has now released emergency updates fixing both critical vulnerabilities. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and developers are urging users to install them immediately. Website owners should confirm that their hosting provider has updated the PHP software running their sites. Updating WordPress or its plugins alone will not resolve the issue.
The warnings have already prompted precautionary shutdowns. Reuters reported that government websites in the Netherlands and Finland were taken offline, while France temporarily disconnected local government administrative websites. Services in Denmark, including a national school communication platform, were also affected. These shutdowns do not necessarily mean the sites were hacked.
Cloudflare says it has deployed firewall protections for customers on free and paid plans using its WAF, after observing attack traffic targeting the flaws. The company stressed that website operators still need to apply the PHP fixes.
ORIGINAL REPORT:
Global cybersecurity agencies are warning organizations to take vulnerable websites offline if they cannot immediately patch a pair of critical PHP flaws. The emergency warnings come as the PHP security team prepares to release an out-of-band security update addressing two severe remote code execution (RCE) vulnerabilities.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both have a critical severity score of 9.2 out of 10 on the CVSS v4.0 scale. The PHP team scheduled the emergency security release for Wednesday, October 21, 2026, at 14:00 UTC.
Why Sites May “Go Dark”
The vulnerabilities could allow unauthenticated attackers to execute malicious code on affected servers over the internet. Successful exploitation could therefore lead to a server takeover.
In response, CERT-EU, the cybersecurity service for EU institutions, bodies, offices and agencies, issued a stark directive. It urged organizations to apply the emergency patches immediately upon release. Those unable to do so should consider taking their affected websites completely offline to prevent cyber intrusions.
The Australian Cyber Security Centre (ACSC) reinforced this stance by instructing administrators to immediately begin actively monitoring their systems for any unusual or malicious activity.
Blast Radius and Potential Consequences of Exploitation
The concern among cybersecurity agencies stems from the fact that PHP is everywhere. It handles backend operations across a substantial proportion of websites worldwide. It is essentially an invisible pillar of the modern internet. Potentially affected systems include content management systems, e-commerce websites, and web hosting platforms.
If these vulnerabilities are exploited, an unauthenticated attacker could gain control of the affected application or server, depending on its configuration and permissions. Such exploitation could also lead to the exposure of corporate databases and user information. Website defacement is also possible through malicious changes to website files or stored content. Moreover, attackers could use automated tools to identify vulnerable servers and potentially deploy ransomware.
Dane Knecht, the CTO of the cloud infrastructure giant Cloudflare, said that attacks were beginning to emerge. In response, Cloudflare and other web application firewall (WAF) providers are actively analyzing the leaked exploit data. The objective is to deploy edge protection rules to block these attacks before they reach their customers’ servers.
Although WAF rules may block known exploitation attempts, their effectiveness depends on the rules and attack methods involved. Attackers may modify their exploit traffic in an attempt to bypass firewall protections. Therefore, the underlying vulnerabilities must be addressed by installing the appropriate PHP security updates.
Fixing these issues presents a complicated challenge for website owners. Updating a WordPress plugin or the CMS alone does not update the underlying PHP runtime and should not be treated as a fix for these vulnerabilities. Since the vulnerabilities exist within the PHP script execution engine itself, the security update must be applied to the PHP runtime used by the website. Depending on the hosting setup, this may require server administration access, a hosting control panel, or coordination with the web hosting provider.
Certificate Security Concerns Add to Website Risks
In addition to the PHP vulnerabilities, another security concern has emerged involving eight intermediate certificate authority (CA) certificates reportedly issued by Indian security firm eMudhra under its emSign brand. This issue concerns the digital credentials used to establish trust online. Together, the incidents highlight the importance of maintaining both server software and the systems that secure online connections.
