GOVERNMENTS ARE TELLING WEBSITES TO GO OFFLINE.

Critical PHP Vulnerabilities Force Websites Offline as Authorities Warn of Cyberattacks

The safest cybersecurity decision may be to shut down.

Imagine discovering that the technology powering your company’s website contains a critical security vulnerability.

Not a weak password. Not an employee clicking a phishing link. Not an outdated plugin that someone forgot to update.

A vulnerability in the underlying programming language responsible for processing requests on the server itself.

Now imagine government cybersecurity authorities advising organizations to consider taking affected systems completely offline until a security patch can be installed.

That’s the situation confronting website operators following the disclosure of severe vulnerabilities affecting PHP, one of the most widely used server-side programming languages on the internet.

According to the reported warnings, European and British cybersecurity authorities have advised organizations to isolate vulnerable internet-facing applications or temporarily shut them down when immediate remediation isn’t possible.

Several websites have already chosen to suspend services rather than risk a potential compromise.

This isn’t simply another website security update. It’s a reminder that the software underneath a website can become its greatest vulnerability.

Two Critical Vulnerabilities With a 9.2 Severity Rating

The PHP security team has confirmed two critical vulnerabilities, each receiving a CVSS v4.0 severity score of 9.2 out of 10.

They are tracked as:

• CVE-2026-109618

• CVE-2026-109619

The PHP team scheduled an emergency security release for Wednesday, October 21, 2026, at 10 a.m. Eastern Time.

In its advance announcement, the team urged PHP users to prepare for immediate upgrades and said complete technical details and affected versions would accompany the release.

The vulnerabilities have been linked to a potentially devastating class of attack known as remote code execution, or RCE.

Remote code execution can allow an attacker to run commands or malicious software on a vulnerable server.

Depending on the server’s permissions and security controls, a successful attack could potentially allow criminals to steal data, install backdoors, modify website content, or compromise connected applications.

A particularly troubling aspect of the reported vulnerabilities is that exploitation may not require a valid username or password.

An attacker could potentially target a vulnerable application simply by sending a specially crafted request over the internet.

CERT-EU has warned of possible unauthenticated remote code execution, although complete technical details were not yet publicly available when its initial advisory was issued.

Why PHP Makes This a Global Cybersecurity Emergency

PHP is not an obscure programming language used by a handful of websites.

It is foundational technology behind many of the internet’s most popular website platforms and business applications.

These include:

• WordPress

• Drupal

• Joomla

• Magento and Adobe Commerce

• Laravel-based web applications

• Custom PHP websites and business portals

PHP typically runs on the server, processing requests, interacting with databases and generating content before delivering it to the visitor’s browser.

When a customer logs into an online store, a patient accesses a web portal, or an employee submits information through a company application, PHP may be responsible for processing some of those interactions.

That is why a vulnerability in the PHP interpreter can be significantly more dangerous than a flaw affecting a single website plugin.

The problem exists deeper in the software stack.

And updating the visible website application may not fix the underlying vulnerability.

WordPress Owners Need to Pay Particular Attention

WordPress relies on PHP to operate.

However, a WordPress update and a PHP runtime update are not the same thing.

Updating WordPress core, themes and plugins does not automatically mean the server’s PHP installation has been patched.

The PHP runtime may be maintained separately by the hosting provider, control panel administrator, operating-system package manager or managed IT provider.

A business could therefore have a fully updated WordPress installation while its underlying PHP environment remains vulnerable.

That distinction is especially important for small businesses that assume automatic WordPress updates cover every component of their website’s security.

Governments Are Taking Websites Offline

The warnings have already prompted an unusual response.

Rather than waiting for a patch while keeping affected services publicly accessible, some organizations have temporarily disconnected websites as a precaution.

The Netherlands’ National Cyber Security Centre reported taking its own public website offline because of the vulnerabilities.

Other affected services reportedly included portions of Wikimedia infrastructure, the bookmarking service Pinboard, and websites in Japan and Europe.

These shutdowns do not necessarily mean the websites were hacked.

In many cases, temporarily suspending access is a preventive measure intended to reduce exposure while administrators prepare patches.

The United Kingdom’s Warning

The UK’s National Cyber Security Centre advised organizations to identify PHP installations, prioritize publicly accessible systems, monitor for malicious activity and apply updates as soon as they become available.

Where immediate remediation is impossible, it recommended considering temporary shutdowns.

The European Union’s Warning

CERT-EU issued similar guidance, advising organizations to identify affected PHP applications and prepare to patch immediately.

For systems that cannot be updated promptly, the agency recommended isolating internet-facing applications from public networks.

These are not routine recommendations.

Government cybersecurity agencies generally recognize that taking a website offline can disrupt operations, customer access and revenue.

The fact that authorities are recommending isolation demonstrates the seriousness of the potential exposure.

Are Hackers Already Exploiting the Vulnerabilities?

There are indications of early exploitation, but the full scope remains uncertain.

Cybersecurity company Patchstack reported receiving information about active exploitation from multiple hosting partners.

Cloudflare also reported observing early attacks and updating its defenses as additional attack methods emerged.

However, early reports of exploitation should not be confused with evidence that every PHP website has been compromised.

There is also a difference between automated scanning, attempted exploitation and a successful intrusion.

The scale of confirmed compromises was not established in the initial reporting.

Nevertheless, the combination of critical vulnerabilities, widespread software usage and emerging attacks makes rapid remediation essential.

Attackers frequently move quickly after vulnerability details become public.

Once security patches are released, criminals can sometimes examine the changes to better understand the underlying flaw.

That can accelerate attacks against organizations that delay updating.

For businesses, the window between public disclosure and successful exploitation can be dangerously short.

What Businesses Should Do Immediately

This is not a vulnerability that should be placed on next month’s maintenance schedule.

If your organization operates a PHP-based website, customer portal or business application, its exposure needs to be assessed immediately.

1. Identify every system running PHP

Start with publicly accessible websites, but don’t stop there.

Check internal business applications, hosting environments, development servers, containers and third-party products that may bundle PHP.

Organizations frequently have applications running PHP without realizing it.

2. Contact your hosting provider

If you use managed WordPress hosting or another hosted PHP platform, ask your provider:

• Which PHP versions are currently running?

• Are our installations affected by CVE-2026-109618 or CVE-2026-109619?

• When will the patched PHP version be installed?

• Are temporary protections active?

• How will you verify that the update was successful?

Do not assume the hosting provider has already completed remediation.

3. Apply the official PHP security update

Install the vendor-supported fixed release as soon as it is available for your environment.

Test application functionality afterward, including logins, forms, database connections, payment processing and integrations.

Organizations running unsupported PHP versions may need to upgrade to a maintained release rather than wait for a patch that might never arrive.

4. Deploy temporary protections, but understand their limitations

Web application firewalls, or WAFs, can help block certain malicious requests.

Cloudflare has reported deploying emergency protections against known attack patterns.

France’s CERT-FR has also identified possible temporary mitigations involving PHP session upload-progress functionality and multipart requests.

However, the agency cautions that these workarounds have not been fully validated, and some address only one of the two vulnerabilities.

A WAF is not a substitute for patching the vulnerable runtime.

5. Consider temporary isolation when immediate patching is impossible

For particularly sensitive or exposed applications, temporarily restricting public access may be safer than leaving a vulnerable server accessible.

A maintenance page, access restrictions or temporary shutdown may be appropriate, depending on the application and available defenses.

This decision should be coordinated with the organization’s IT and security teams, especially when critical services are involved.

6. Investigate potential compromise

Patching prevents future exploitation of the fixed vulnerability, but it does not automatically remove a backdoor installed before the update.

Review web server logs, suspicious POST requests, unexpected file changes, newly created accounts and unusual outbound connections.

Where suspicious activity is identified, initiate an incident response investigation rather than assuming the patch alone resolves the problem.

Why Healthcare, Law Firms and Schools Face Particular Risks

For organizations handling sensitive information, the consequences of a compromised web server can extend far beyond website downtime.

Healthcare organizations may operate patient portals, scheduling systems and web applications connected to sensitive medical information. A successful intrusion could create privacy, compliance and operational risks.

Law firms may use web-based client portals, document-sharing systems and intake forms. Compromise could expose confidential client communications or sensitive case information.

Schools may rely on websites and applications for parent communications, enrollment, student services and administrative operations. A vulnerable application could expose data or interrupt essential services.

Small and midsize businesses may depend on a single website for online sales, appointment bookings, lead generation or customer support. Even a short outage can have financial consequences.

For an MSP or managed IT provider, this incident highlights the importance of maintaining a complete inventory of applications and the software components supporting them.

Cybersecurity cannot stop at the visible website.

The operating system, web server, programming runtime, application framework, database and third-party integrations all require ongoing maintenance and security monitoring.

The Bigger Lesson: Your Website Is Only as Secure as Its Foundation

One of the most dangerous assumptions in cybersecurity is that a website is safe simply because it has HTTPS, a firewall and updated plugins.

Those controls matter.

But they cannot compensate for every vulnerability in the underlying software.

A business might invest heavily in endpoint security, multifactor authentication, phishing protection and immutable backups while overlooking an aging PHP installation exposed directly to the internet.

Attackers do not care which security controls an organization purchased.

They look for the weakest accessible point.

The current PHP emergency illustrates why effective cybersecurity requires multiple layers of defense, continuous vulnerability management and the ability to respond rapidly when critical flaws are disclosed.

Sometimes that response means applying an urgent update.

Sometimes it means restricting access.

And sometimes, as European and British authorities have warned, it means taking a vulnerable service offline until it can be secured.

A temporary outage is inconvenient. A compromised server can become a business crisis.

70% of all cyber attacks target small businesses, I can help protect yours.

#Cybersecurity #PHP #WordPressSecurity #ManagedIT #DataProtection

GOVERNMENTS ARE TELLING WEBSITES TO GO OFFLINE.

Two critical vulnerabilities have been discovered in PHP, the programming language behind WordPress and countless other websites.

Both are rated 9.2 out of 10 for severity.

Security researchers are reporting early attacks, and European cybersecurity authorities are advising organizations to isolate vulnerable systems if they cannot patch them immediately.

Even a fully updated WordPress site may still have a vulnerable PHP installation underneath.

Sometimes the safest cybersecurity decision is to shut down before hackers get in.