Critical PHP Vulnerabilities Prompt Global Website Shutdowns

• •Critical vulnerabilities in PHP affect 70% of websites globally.
• •Governments and organizations are taking websites offline to mitigate risks.
• •Emergency patches have been released, but no exploitation has been confirmed yet.

On October 22, 2026, critical vulnerabilities in PHP, a programming language used by approximately 70% of websites, were discovered by AI, prompting urgent action from governments and organizations worldwide. The vulnerabilities could allow hackers to access servers' file systems or databases. Multiple government websites, including those of Canada, Finland, and the UK, were taken offline as a precautionary measure. The US National Security Agency and other international cybersecurity agencies advised website operators to patch their systems immediately or take them offline. The PHP Foundation released emergency patches for the vulnerabilities, which had gone undetected for over a decade. Despite the severity of the flaws, there are currently no confirmed reports of exploitation. The vulnerabilities were rated 9.2 out of 10 for severity by the PHP security team. The situation remains fluid as organizations scramble to implement the necessary fixes.