Severe PHP Security Flaws Force European Government Sites Offline

Two high-severity security vulnerabilities in PHP have forced government websites in Europe offline and triggered warnings worldwide.

NationPulse Desk

Oct 22, 2026 · 12:40 PM 2 min read

Key takeaways

Two critical PHP security flaws, CVE-2026-109618 and CVE-2026-109619, scored 9.2 out of 10 in severity.

Government agencies in the Netherlands and Finland took their websites offline on Wednesday as a safety measure.

PHP developers released patches on October 21, 2026 at 13:40 UTC.

CERT-EU stated that every PHP version from PHP 5 onward could carry these flaws.

European government portals went offline on Wednesday due to two critical security vulnerabilities in PHP, each assigned a severity score of 9.2 out of 10 under the identifiers CVE-2026-109618 and CVE-2026-109619.

Because PHP serves as the underlying programming language for a massive share of internet sites, including WordPress, Drupal, Joomla, and Magento, these weaknesses endanger countless web platforms globally.

The vulnerabilities permit malicious actors to execute harmful code on any exposed server without requiring credentials or authentication. CERT-EU noted that PHP versions starting from PHP 5 and later may harbor these issues. Additionally, GoDaddy cautioned that intruders could extract information, alter website appearances, or gain complete authority over servers.

Government authorities in Finland and the Netherlands disconnected their web pages defensively. These precautionary suspensions occurred to block potential harm before software patches became available, rather than responding to confirmed breaches.

Major European cybersecurity authorities released a joint advisory, with ENISA, CERT-EU, the European Commission, and Europol EC3 strongly advising entities to install PHP updates right away. They suggested disconnecting web applications from public networks if patching is delayed, noting that hidden PHP dependencies mean some programs carry risks without obvious indicators.

The Cyber Division of the FBI published a separate notice advising entities to disconnect unvetted systems until updates are installed. The FBI additionally requested that administrators monitor servers for unusual behavior like PHP processes opening command shells.

The Australian cybersecurity authority released comparable instructions while confirming no active exploitation has been observed.

Local platforms in Pakistan face significant danger from these bugs as well, since numerous official portals, financial services, and online stores rely on PHP or WordPress. Consequently, entities across Pakistan need to verify PHP editions and install fixes promptly.

Developers published the PHP software corrections on October 21, 2026 at 13:40 UTC, which corresponds to 6:40 PM Pakistan Standard Time. Researchers at watchTowr verified they successfully duplicated one of the flaws, and while hacking attempts surfaced, no verified compromises have occurred yet.

Questions and answers