Two critical security flaws in PHP forced government websites in Europe to go offline on Wednesday. The two flaws, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 out of 10 in severity.
PHP is the programming language behind most of the internet’s websites. It powers platforms like WordPress, Drupal, Joomla, and Magento. As a result, these flaws put a large number of websites at risk worldwide.
The bugs allow attackers to run harmful code on any vulnerable server without needing a password or login. CERT-EU said that every PHP version from PHP 5 onward could carry these flaws. Furthermore, web hosting company GoDaddy warned that attackers could steal data, deface websites, or take full control of servers.
| Tracking ID | Bug | What an attacker can achieve | What experts demonstrated |
|---|---|---|---|
| CVE-2026-109618 | Upload-progress unserializer use-after-freeRemote process-memory disclosure | Corrupt process memory and execute codeUnauthenticated disclosure of PHP worker memory | Pre-authentication RCE on WordPress, Drupal and JoomlaApplication-agnostic remote memory disclosure |
| CVE-2026-109619 | Fatal-error backtrace use-after-freeOPcache type confusion | Corrupt process memory and execute codeCorrupt shared PHP state and execute code | Pre-authentication RCE on DrupalPre-authentication RCE on WordPress |
In response, government agencies in the Netherlands and Finland shut down their websites as a safety measure. However, these shutdowns did not mean the sites had already faced attacks. Instead, the agencies took their sites offline to prevent any possible damage before patches arrived.
The EU’s top cybersecurity bodies issued a joint statement on the matter. ENISA, CERT-EU, the European Commission, and Europol EC3 all urged organizations to apply the PHP security updates immediately. They also told organizations to isolate any internet-facing apps from public networks if patching takes time. The statement also warned that many products use PHP in the background, so some apps may carry the risk without appearing to.
Meanwhile, the FBI’s Cyber Division posted its own advisory. It told organizations to take unpatched systems offline until they can apply the fix. The FBI also asked administrators to watch their servers for suspicious activity, such as PHP processes launching command shells.
Australia’s cybersecurity agency also issued similar guidance and said it has not seen any active exploitation yet.
Pakistani websites could also face serious risk from these flaws. Many government portals, banking platforms, and e-commerce sites in Pakistan run on PHP or use WordPress as their base. As a result, organizations in Pakistan should check their PHP versions and apply the patches as soon as possible.
PHP developers released the patches on October 21, 2026 at 13:40 UTC (6:40 PM Pakistan Standard Time). Security researchers at watchTowr confirmed that they successfully reproduced one of the bugs. Still, no confirmed attacks have taken place so far, though reports of hacking attempts have already appeared.
