A serious cybersecurity alert has prompted organisations in several countries to temporarily take websites offline after developers identified two critical vulnerabilities in PHP, a programming language widely used to operate websites and online services.

The security incident has raised concerns among government agencies, hosting providers, technology companies and website administrators because PHP supports a substantial portion of the internet. Organisations are being urged to install the relevant security updates immediately or isolate vulnerable systems until they can be protected.

Government Websites Taken Offline as a Precaution

Authorities in the Netherlands and Finland were among those taking precautionary measures, while French authorities also temporarily disabled certain administrative websites while awaiting a security fix.

The disruptions affected a range of public-facing services, demonstrating how a vulnerability in widely deployed software can create challenges across multiple countries simultaneously.

The precautionary shutdowns were intended to reduce potential exposure while administrators assessed their systems and prepared to apply the necessary updates.

Why the PHP Vulnerabilities Are Serious

PHP is used to build and operate dynamic websites, content management systems and server-side applications. It underpins platforms such as WordPress, Drupal, Joomla and Magento.

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were rated critical, with severity scores of 9.2 out of 10 under the CVSS v4.0 system.

According to the PHP development team’s security announcement, the flaws could permit remote code execution without authentication under affected configurations. Such weaknesses can potentially allow an attacker to execute unauthorised commands on a vulnerable server.

The exact exposure depends on the software version, server configuration and whether the affected system has been updated.

Security Updates Become an Immediate Priority

On October 21, the PHP project released patched versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Security specialists are advising organisations to identify all systems running PHP, determine which versions are installed and apply the appropriate supported updates without delay.

Website owners should not assume that routine application or plugin updates will automatically update the underlying PHP runtime. Server-level maintenance may require action from the hosting provider or system administrator.

Where an affected system cannot be patched promptly, restricting public access may be necessary until appropriate protection is in place.

Potential Consequences for Businesses and Public Services

A successful attack against a vulnerable server could potentially result in data theft, website defacement, unauthorised access or broader system compromise.

For businesses, these incidents can lead to service interruptions, recovery expenses, reputational damage and disruption to customer services. Government portals, healthcare organisations, educational institutions and online retailers may face particular operational challenges if their websites become unavailable.

The incident also highlights the importance of maintaining an accurate inventory of server software and establishing clear procedures for responding to emergency security advisories.

What Organisations Should Do Next

Organisations should review official PHP security guidance, identify potentially affected installations, apply the relevant patches and investigate any signs of suspicious activity.

Administrators should also review server logs, strengthen access controls and ensure that backups and incident-response procedures are available if further action becomes necessary.

The incident demonstrates how a flaw in widely used foundational software can rapidly become an international cybersecurity concern. Prompt patching and coordinated responses will be essential to reducing the risk of further disruption.