Governments Take Websites Offline Over Two Critical PHP Flaws
Governments in several European countries have taken some websites offline as a precaution against two serious security flaws in PHP, a programming language used to build websites. Al Jazeera reported that more than 70 percent of websites use PHP, and that the two flaws, dubbed PHP2Shell, allow an attacker to run commands remotely on a server running older PHP code. No password or legitimate account is needed to do so.
Germany's Federal Ministry for Digital Transformation and Government Modernisation took some of its websites offline as a preventive measure. France's Ministry of the Interior deactivated the official websites of local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic shut down websites so that a security patch could be applied.
Outside Europe, the U.S. National Security Agency advised all organizations using PHP to prepare for an update covering two critical vulnerabilities. If a site could not be updated immediately, the agency said, it should be taken offline. Japanese Prime Minister Sanae Takaichi warned about the risk on social media. An EU agency also warned that websites may need to be taken offline while PHP prepared its patches, according to Reuters.
The flaws were found by two groups of researchers. Researchers at the security firm Calif, working with OpenAI, reported the first flaw on August 11. Wiz reported the second on August 24. Al Jazeera also reported that artificial intelligence was used to pinpoint the two vulnerabilities. OpenAI said that over the past two months it had led a coalition of maintainers, the people who look after the software, researchers and security providers working to address the flaws.
On 20 October, the PHP project announced an upcoming security release to fix the two vulnerabilities, which are identified as CVE-2026-109618 and CVE-2026-109619. CVE is the standard system for numbering publicly known security flaws. Both are rated 9.2 out of 10, "Critical," under the CVSS v4.0 scoring system. The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Officials said all PHP versions from PHP 5 onward could be affected.
The U.S. Cybersecurity and Infrastructure Security Agency issued an alert titled "Critical Vulnerabilities in PHP Require Immediate Patching," and strongly urged organizations to patch right away. The nonprofit PHP Foundation said the flaws were among the most severe it had encountered, and urged website administrators to update their code immediately.
