23:43Machine-translated from Russian by AIRead in Azerbaijani
Critical PHP Vulnerabilities Prompt Government Agencies and Media Outlets Worldwide to Take Websites Offline
PHP developers have already released emergency updates addressing two critical vulnerabilities that, under certain conditions, allow code to be executed on a server without authentication. Authorities and organizations in various countries are temporarily taking online resources offline to prevent potential cyberattacks.
On October 21, the developers of the PHP programming language released fixes for two critical vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. Both issues received a score of 9.2 out of 10 on the CVSS scale. Exploiting them could allow attackers to remotely execute arbitrary code on vulnerable servers, potentially gaining access to files, databases, and other system resources.
The vulnerabilities affect various versions of PHP, dating back to the language's early releases. PHP is widely used for the back end of web applications, including on the WordPress, Drupal, and Joomla platforms. Researchers estimate that the issue could potentially affect about 70% of online resources, but this estimate has not been independently confirmed.
As a preventive measure, government agencies, companies, and media outlets in several countries temporarily took their websites offline. In the Netherlands, the restrictions affected the online resources of the National Cyber Security Centre, the Port of Rotterdam, the largest political parties, and several hospitals. In France, prefecture websites were temporarily taken offline; in Finland, government web services were suspended; and in the Czech Republic, the government website was taken offline to install security updates. The Wikimedia Foundation also reported that some of its systems had been temporarily shut down.
Cybersecurity agencies in the United States, the United Kingdom, the European Union, and other countries issued warnings about the need to update PHP urgently. According to Novaya Gazeta Europe, Cloudflare's chief technology officer reported the first attempted attacks exploiting the identified vulnerabilities. However, when the U.S. agency CISA published its warning, it had no data confirming that these flaws had been exploited in real-world attacks.
Administrators are advised to install the fixes immediately, check all servers and applications that use PHP, including components of third-party products, and analyze event logs for suspicious activity. If an immediate update is not possible, publicly accessible systems should be temporarily isolated from the internet until the threat has been eliminated. The relevant recommendations were published by CERT-EU, the computer incident response center for the institutions and bodies of the European Union.
The incident once again demonstrated how far-reaching the consequences of flaws in widely used software components can be: even if an organization does not develop its own software in PHP, the vulnerability may be present in a CMS, web application, or third-party service it uses.