Critical PHP Vulnerabilities Prompt Global Website Shutdowns

• •Two critical PHP vulnerabilities were disclosed, affecting 70% of websites.
• •Immediate patches were released, with many sites taken offline as a precaution.
• •No confirmed mass exploitation has occurred, but probing attacks have been observed.

On October 21, 2026, the PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution on PHP-based websites. Affecting an estimated 70% of the internet, these flaws prompted immediate patch releases and widespread precautionary measures, including the temporary shutdown of numerous government and business websites across Europe and Canada. Cybersecurity agencies, including CISA and the FBI, have urged organizations to update their PHP installations immediately or take their systems offline until the patches are applied. Reports indicate that hackers have begun probing for these vulnerabilities, although no mass exploitation has been confirmed yet. The vulnerabilities were discovered with the assistance of AI tools, highlighting the dual-use nature of AI in cybersecurity. The PHP Foundation has emphasized the urgency of applying the patches to mitigate potential risks.