Developers of the PHP programming language released emergency patches Wednesday for two critical security flaws that could let hackers remotely take over websites and servers, prompting governments and major online services to shut down sites as a precaution.
“All PHP users are strongly encouraged to update immediately,” the open-source project’s team said in an online statement. The PHP Foundation was more blunt in a blog post: “If you run PHP, it is imperative that you update now.”
PHP is free and helps power around 70 percent of the world’s websites, including critical infrastructure and government portals, news sites and online shops.
The two vulnerabilities, labelled CVE-2026-109618 and CVE-2026-109619, could allow attackers to bypass usual barriers such as password-protected accounts. Malicious actors could use them to reach government databases and customer data, deface websites or compromise entire businesses and online services. The PHP security team rated both 9.2 out of 10 for severity.
Cybersecurity authorities urged organisations to update affected systems immediately or, if that was not possible, take them offline until they could be secured.
AI tools used to find the flaws
The weaknesses were flagged in August by two security companies, Calif and Wiz, both of which used artificial intelligence tools. Calif identified one of the flaws during an OpenAI-funded audit of PHP, and OpenAI said its GPT-5.6 Sol model was used in that research. Google-owned Wiz independently discovered and reported both.
Developers kept the details confidential while preparing a fix, but news of the flaws leaked Tuesday, a day before the scheduled update, intensifying the race to secure vulnerable systems.
Researchers had initially reported little evidence of widespread exploitation, but attempted attacks have since been detected. Dane Knecht, chief technology officer of security firm Cloudflare, said hours before the patches were released that hackers were already trying to exploit the flaws. “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” he said in an online post. Amazon Threat Intelligence also reported exploitation attempts, including activity before the public disclosure.
The Wikimedia Foundation, which runs Wikipedia, said it was addressing the vulnerabilities. “We have taken down a number of other systems as a precautionary measure until they can be safely patched,” it said, warning users that some disruption could occur.
Authorities in several countries, including Australia and Japan, issued warnings, and a number of European governments took websites offline.
In France, the Paris Police Prefecture website was taken down due to the “detection of a critical security vulnerability”, along with local government pages. Germany’s federal IT provider ITZBund shut down several government websites, though German officials said the move was precautionary and that no security incidents had been identified. Belgium’s Foreign Ministry temporarily blocked its own online presence, and government and public-service sites in the Netherlands and Finland were also taken offline.
The US National Security Agency warned that such vulnerabilities “often provide a direct path to the server’s file system or database”, and advised organisations that cannot update immediately to take affected systems offline until fully mitigated. The White House said it was informed of the issue last week and that federal agencies were assessing the potential impact on government systems and infrastructure.
In Britain, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems, monitor them for suspicious activity and install updates as soon as possible.
