Rabat – Government websites and online services worldwide have been temporarily taken offline after researchers discovered two critical security vulnerabilities in PHP, a programming language widely used to power websites and web applications.
The PHP development team released emergency security updates on Wednesday, October 21, addressing vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Both carry severity scores of 9.2 out of 10 and could allow attackers to execute malicious code remotely without authentication. Cybersecurity agencies urged organizations to install the updates immediately or consider taking vulnerable systems offline.
Governments take websites offline
Finland temporarily suspended its government’s public web services as a precaution, while the Netherlands’ cybersecurity agency announced that it was taking its website offline.
Other Dutch government websites were also affected, including those of the National Institute for Public Health and the Environment and the Tweede Kamer, the lower house of parliament.
The Wikimedia Foundation, which operates Wikipedia, confirmed that it was addressing the vulnerabilities and had temporarily disabled several systems while security patches were being applied.
“We have deliberately taken many of our supporting services offline until they can be safely patched,” the foundation said.
The measures left some users unable to access parts of Wikipedia on Wednesday.
In the United Kingdom, Edinburgh Council’s website became inaccessible, alongside websites for several BBC programmes, including Doctor Who and The Traitors.
However, neither organization confirmed that the disruptions were directly linked to the PHP vulnerabilities.
Art platform DeviantArt also announced that its website was temporarily unavailable for maintenance without specifying whether the security flaws were responsible.
Cybersecurity agencies warn of potential attacks
The US National Security Agency advised organizations unable to immediately apply the available fixes to consider taking affected systems offline.
“These vulnerabilities often provide a direct path to the server’s file system or database,” the agency warned in a post on X.
The White House said federal agencies were working with leading artificial intelligence laboratories to accelerate efforts to address the security issue.
Japanese Prime Minister Sanae Takaichi also urged organizations and individuals to check whether their publicly accessible websites use PHP.
The UK’s National Cyber Security Centre issued similar guidance, recommending temporary shutdowns when immediate remediation was not possible.
The agency advised organizations unable to install the updates or implement temporary safeguards promptly to consider taking affected systems offline until the vulnerabilities can be fully addressed.
The European Union Computer Emergency Response Team, CERT-EU, warned that the vulnerabilities could potentially allow unauthenticated remote code execution, a type of attack that may enable hackers to execute malicious commands on vulnerable servers without first logging in.
Such access could allow attackers to install malware, compromise sensitive information, or disrupt online services.
Dane Knecht, chief technology officer at Cloudflare, reported observing signs of emerging attacks and said the company was updating its protective measures as new methods of exploitation appeared.
AI uncovers vulnerabilities hidden for over a decade
The discovery has also highlighted the growing role of artificial intelligence in cybersecurity research.
Researchers at Calif and Wiz independently identified critical vulnerabilities using advanced artificial intelligence. Calif used OpenAI’s GPT-5.6 Sol model to identify one flaw, while Wiz used a combination of OpenAI and Google models to discover and investigate the vulnerabilities, which had existed in PHP’s codebase for more than a decade.
OpenAI described the vulnerabilities in a blog post as “one of the most impactful security issues in recent memory,” citing their severity and the widespread use of PHP.
According to Wiz, advanced AI models made it possible to develop and adapt working exploits across multiple applications within hours, significantly accelerating a process that would traditionally require extensive manual research.
Wiz estimated that PHP powers roughly 70% of websites worldwide, illustrating the potential scale of exposure. However, the figure does not establish how many websites remain vulnerable or have been compromised, and the BBC said it could not independently verify the estimate.
The findings demonstrate how AI can help cybersecurity researchers identify previously unknown weaknesses, while also raising concerns about how similar capabilities could be exploited by malicious actors.
Why PHP vulnerabilities pose a widespread risk
PHP is a server-side programming language used by a substantial portion of the internet, including websites built with popular content management systems such as WordPress, Drupal, Joomla, and Magento.
It is also widely integrated into hosting platforms, administration tools, and third-party applications, sometimes without organizations being fully aware of its presence.
Cybersecurity company Huntress warned that PHP’s widespread use makes identifying every potentially vulnerable system particularly challenging.
Don Smith, a cybersecurity expert at the Sophos Counter Threat Unit, told the BBC that the vulnerabilities would likely become a priority target for hackers.
He explained that the challenge extended beyond installing updates, as organizations must first identify every instance of PHP operating within their infrastructure.
Smith also warned that administrators should examine their systems for evidence that attackers may already have gained access.
According to CERT-EU, the vulnerabilities could affect PHP versions dating back to the PHP 5 generation, while researchers at Wiz identified potentially affected releases as old as PHP 5.4.
The PHP development team released security updates for versions 8.2, 8.3, 8.4, and 8.5. Although PHP 8.1 and older no longer receive regular updates from the project, developers have provided limited source-level fixes for versions 7.4, 8.0, and 8.1, while some software vendors may offer additional patches.
Organizations using older versions are nevertheless being urged to move to supported releases.
Security updates released as organizations assess exposure
A security update was released on Wednesday afternoon, but the extent of the vulnerabilities’ impact remains uncertain.
Cybersecurity authorities have advised organizations to apply the fixes promptly, assess their exposure, and monitor systems for suspicious activity.
The UK’s National Cyber Security Centre also recommended continued monitoring of third-party software updates, particularly for products and services that include PHP as an underlying component.
While several government agencies and online platforms have already taken precautionary action, the full number of affected websites and the extent of any successful cyberattacks have not yet been established.
The incident has placed renewed attention on the security of widely used internet infrastructure and the challenges organizations face when critical vulnerabilities emerge in software supporting millions of websites worldwide.
