The Hague / Washington, 21 October. The developers of the PHP programming language released emergency fixes for two critical vulnerabilities that give attackers the ability to run code remotely on a server, and government websites were temporarily taken offline as a precaution in 13 countries, according to a TASS count.
The vulnerabilities were assigned the numbers CVE-2026-109618 and CVE-2026-109619. According to the developers' description, they involve memory-handling errors and outdated internal state that can persist between requests; they can be exploited without authentication, and any PHP installation that handles web requests is potentially at risk. PHP runs on the server side: it receives a visitor's request, gathers the necessary data and sends the finished page to the browser. Sites built on WordPress, Drupal, Joomla and Magento run on it.
The US National Security Agency asked organisations to prepare for an immediate update: in its assessment, such vulnerabilities often provide a direct path to a server's file system or database, and if an immediate update is not feasible, the system should be taken offline until the threat is fully mitigated. The FBI's Cyber Division urged organisations to update PHP, draw up an inventory of systems running it, start with internet-facing servers and watch for suspicious activity, such as PHP processes unexpectedly launching command shells or downloading files.
Artificial intelligence helped find the flaws. According to OpenAI, as cited by RBC, one of the vulnerabilities was identified with the help of the GPT-5.6 Sol model under the Patch the Planet initiative, and for two months the company worked with researchers, developers and cybersecurity specialists to prepare fixes before public disclosure.
The shutdowns swept across Europe. In the Netherlands, according to Reuters as cited by Kursiv, the National Cyber Security Centre suspended its own systems; the government portal Overheid.nl and the websites of the Port of Rotterdam, the football association KNVB, the five largest political parties and several hospitals were taken offline. In Denmark the restrictions affected the national platform for information exchange between schools, in Finland the state IT service provider Valtori took public government online services offline as a precaution, France's Interior Ministry put its websites into maintenance mode, and the organisation that supports Wikipedia temporarily took some of its systems offline. Japan suspended several websites, including government services, and Japan and Australia urged urgent updates.
Even the Internet Archive — an online library that keeps copies of other people's web pages — briefly closed while it updated.
In Russia, according to Valentin Malykh, head of the large language model development centre at MWS AI, tens of thousands of websites could be at risk. The vulnerabilities potentially affect Kazakh sites running on PHP as well, but there have so far been no reports of local services being taken fully offline, Kursiv notes.
What it means: Flaws in a language that powers a large share of websites were found with the help of AI, and the governments of a number of countries chose to take their sites offline temporarily while fixes were installed. The danger remains for those who do not update: the published fixes help attackers understand how the flaw works.
Who benefits: Experts say small websites whose owners have few technical resources are most at risk: on shared hosting, server updates are usually installed by the provider, so site owners depend on how quickly it acts. Automattic said users of its hosting, including WordPress.com and Tumblr, are protected. Technology companies warn that hackers have already begun exploiting the flaws.
Background: The vulnerabilities had gone unnoticed for years until specialists found them with the help of AI, but the same AI, experts say, may also speed up their exploitation by hackers. Tiffany Farriss, interim CEO of the Drupal Association, said the problem affects a large part of the internet.
List of sources used: Anadolu, TASS, Kursiv, RBC
Artificial intelligence was used in preparing this material.
