Home · World · Oct 22 archive
Global Websites Disrupted as PHP Security Flaws Prompt Patching Rush
Confirmed
In Short: On Thursday, global firms and governments rushed to patch critical flaws in the PHP programming language, which underpins much of the internet, after vulnerabilities were disclosed.
On Thursday, global firms and governments rushed to patch critical flaws in the PHP programming language, which underpins much of the internet, after vulnerabilities were disclosed.
French telecoms group Orange temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.
Finland’s state IT services provider Valtori continued installing PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public web services a day earlier.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said that details of the flaws had become public before fixes were ready, with attacks reported since.
PHP helps run about 70% of the world's websites, from online stores and news outlets to government services, according to Wiz Research, one of the cybersecurity firms that found the two flaws.
Volker Dusch, a security engineer at the PHP foundation, told the Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.
Larger institutions, from government agencies to news outlets, should be able to fix their websites relatively fast, but others may be left vulnerable.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell,” can let an attacker take control of a web server without logging in.
In Finland, one of the most digitized countries in the world, the government’s public websites were temporarily shut down, forcing even basic tasks to pause.
Many took their websites down as an emergency precaution while they fixed the flaw, which was identified using artificial intelligence.
European government websites were taken down, and major sites like Wikipedia were affected.
Organizations around the world have taken websites offline while they waited for the fix.
Background
Global firms and governments rushed to patch critical flaws in the PHP programming language, causing disruptions to many websites.
What's confirmed
- PHP programmers released a fix Wednesday, and the U.S. National Security Agency told organizations to patch their sites immediately or pull vulnerable systems offline, a call echoed by authorities from Japan to the European Union.
- The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”, can let an attacker take control of a web server without logging in.
What's still developing
- “They may run a website using PHP but don’t really keep a close eye on it,” he said.
- The push came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.
- Read next: AI-powered cyberattacks are forcing RIAs to rethink client security Few advisors will ever touch PHP, but many of their websites run on it.
- It warned that flaws of this kind “often provide a direct path to the server’s file system or database”.
- In July, attackers went after two chained flaws in WordPress itself, dubbed WP2Shell, which allowed sites to be taken over without a login.
- But the flaw and the temporary shutdowns it provoked showed how far-reaching potential cyberattacks could be — and how deeply the internet has embedded itself into our lives.
- Counterparts in the US, UK, Australia and the European Union went further, telling organizations to take systems offline if they couldn’t patch right away.
- Neither flaw had been added to the US government’s list of known exploited vulnerabilities by Wednesday evening.
- Canadian advisory firms whose websites, client portals or vendors depend on the software are caught up in it.
- Security firm watchTowr says its network of decoy servers has recorded attempts to exploit both flaws, and web security firm Patchstack says it has confirmed several attacks, though it hasn’t published details.
- OpenAI, whose model Calif used, called them “one of the most impactful security issues in recent memory”.
- “It’s in the fabric of our society, a lot of these services,” said Kalle Pusa, 33, a software developer who is involved in Helsinki city politics.