PHP Security Flaws Explained: Why Websites Worldwide Were Taken Offline
Two critical security vulnerabilities in PHP triggered an urgent cybersecurity response in October 2026, prompting organisations in several countries to apply emergency updates and temporarily take some websites offline. The vulnerabilities raised concerns because PHP is widely used to operate websites, online services and content management systems.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow remote attackers to execute malicious code on vulnerable servers without logging in. The PHP development team released security updates on October 21, while cybersecurity agencies advised organisations to identify affected systems and install the fixes as quickly as possible.
What Is PHP and Why Is It Important?
PHP is an open-source programming language used primarily for server-side web development. It allows websites to process user requests, interact with databases, manage account information and generate dynamic web pages.
Many websites rely on PHP directly or through software built on top of it. WordPress, one of the world's most widely used content management systems, uses PHP extensively. The language is also used by businesses, public institutions, online publishers and e-commerce platforms.
Because PHP operates behind the scenes, website visitors may not know whether a particular service depends on it. Some applications and third-party products also include PHP components without making that dependency obvious to the organisation using them.
This widespread adoption meant that the newly disclosed vulnerabilities required attention from website administrators, hosting providers, software developers and government cybersecurity teams.
What Are the Two Critical Vulnerabilities?
The two vulnerabilities were assigned the identifiers CVE-2026-109618 and CVE-2026-109619. India's Computer Emergency Response Team, known as CERT-In, issued a critical security advisory on October 21, warning that the flaws could allow remote attackers to execute arbitrary code on affected systems.
According to the advisory, the vulnerabilities involve memory corruption and improper resource control. An attacker could potentially send a specially crafted request to a vulnerable server and exploit the way PHP handles the request.
Successful exploitation could allow an attacker to run unauthorised instructions on the affected system. Depending on the server's configuration and the permissions available to the attacker, this could lead to data theft, website defacement, unauthorised access or a broader compromise of the server.
Both vulnerabilities received a CVSS v4.0 severity score of 9.2 out of 10, indicating a critical level of risk.
The vulnerabilities are particularly concerning because authentication may not be required for exploitation. In practical terms, a vulnerable internet-facing service could be exposed even if an attacker does not have a legitimate account.
However, the existence of a vulnerability does not automatically mean that every website using PHP has been compromised. The actual risk depends on the software version, system configuration, exposure and whether the relevant security updates have been installed.
Why Were Websites Taken Offline?
Following the disclosure, some organisations temporarily took websites or online services offline as a precaution. These decisions were intended to reduce the risk of attacks while administrators prepared or applied security fixes.
Reuters reported that affected services included websites and platforms associated with public institutions and major organisations. The precautionary shutdowns demonstrated how a vulnerability in widely used software can affect services across different countries and industries.
Cybersecurity agencies advised organisations to install the available fixes immediately. Where administrators could not secure a vulnerable system promptly, agencies recommended considering temporary isolation from public networks.
Taking a website offline is not the same as confirming that it has been hacked. In many cases, it is a preventive measure designed to reduce exposure until the system can be updated and checked.
Updating PHP can also be complicated. Some organisations operate multiple servers, applications and legacy systems. Others depend on hosting providers or third-party vendors to manage the underlying software. These factors can delay the identification and repair of every affected installation.
How Were the Vulnerabilities Discovered?
The discovery also attracted attention because artificial intelligence tools contributed to the security research.
OpenAI said that Calif, a security research company, identified one of the vulnerabilities using GPT-5.6 Sol as part of its Patch the Planet initiative. Security company Wiz independently discovered and reported both vulnerabilities. Researchers, software maintainers and security partners coordinated to investigate the issues and prepare fixes before public disclosure.
The case illustrates how AI can help security researchers analyse software and identify weaknesses that might otherwise remain undetected. It also highlights a potential concern: similar capabilities could help malicious actors investigate vulnerabilities and develop attacks more quickly.
Responsible disclosure is therefore important. Security researchers generally report serious flaws to software maintainers so that fixes can be prepared and distributed before detailed technical information becomes widely available.
In this case, information about the vulnerabilities began circulating before the originally planned disclosure timeline. The PHP team consequently released the security updates on October 21.
Which PHP Versions Need Updating?
CERT-In identified the following affected PHP releases:
PHP 8.5 versions earlier than 8.5.12.
PHP 8.4 versions earlier than 8.4.27.
PHP 8.3 versions earlier than 8.3.36.
PHP 8.2 versions earlier than 8.2.35.
The PHP development team released the corresponding security updates to address both vulnerabilities. Administrators should consult the official PHP security announcement and their hosting provider's instructions to identify the correct update for their systems.
Organisations using older or unsupported PHP versions should not assume that they are protected. They should check whether a security fix is available for their deployment and plan a move to a supported version where necessary.
How Can Website Owners and Users Stay Safe?
Website administrators should first identify all systems running PHP, including websites, internal applications and software supplied by third parties. Internet-facing systems should receive priority because they are directly accessible to potential attackers.
Administrators should then install the appropriate security updates, verify that the corrected versions are running and monitor logs for suspicious activity. If a system cannot be patched immediately, they should follow official guidance on restricting access or temporarily isolating it.
Businesses should also review access permissions, protect credentials, maintain secure backups and investigate unusual activity. Installing a patch is essential, but organisations should still assess whether a vulnerable system was exposed before the update was applied.
For ordinary internet users, there is no need to stop using every website built with PHP. Users should keep their devices and browsers updated, use strong and unique passwords, enable multifactor authentication where available and avoid suspicious links or unexpected requests for personal information.
Conclusion
The PHP vulnerabilities demonstrate how a weakness in widely used software can create urgent security challenges for organisations around the world. Although some services were temporarily taken offline as a precaution, the incident does not mean that every PHP-based website was compromised.
The immediate priority is to install the official security updates, verify affected systems and monitor for signs of unauthorised activity. The incident also highlights the growing role of AI in cybersecurity research and the importance of cooperation between researchers, software developers, hosting providers and government agencies.
