Home · World · Oct 22 archive
PHP Security Flaws Spark Global Patching Effort, Disrupt Websites
Confirmed
In Short: Global firms and governments rushed to patch critical flaws in the PHP programming language, causing disruptions to many websites.
Global firms and governments scrambled on Thursday to patch critical flaws in the PHP programming language, which underpins much of the internet. The vulnerabilities, known as PHP2Shell, were disclosed by security researchers, leading to millions of hacking attempts, according to cloud firm reports.
French telecoms group Orange temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution. Meanwhile, Finland’s state IT services provider Valtori continued installing security patches overnight and gradually lifted precautionary service blocks after shutting down government public web services a day earlier.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, noted that the details of the flaws had become public before fixes were ready, resulting in reported attacks. She emphasized the importance of updating old PHP versions to prevent system-wide vulnerabilities.
The push to patch came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday, while website operators scrambled to secure systems running the software. PHP helps run about 70% of the world's websites, from online stores and news outlets to government services, according to Wiz Research.
Volker Dusch, a security engineer at the PHP foundation, told the Wall Street Journal that this was the most serious problem PHP had faced in over a decade, comparing it to the Heartbleed flaw in 2014. PHP programmers released a fix on Wednesday, and the U.S. National Security Agency urged organizations to patch their sites immediately or pull vulnerable systems offline.
Larger institutions, such as government agencies and news outlets, should be able to fix their websites relatively fast, but smaller organizations may be left vulnerable, according to Kerrison. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow an attacker to take control of a web server without logging in, providing a direct path to the server’s file system or database.
OpenAI, whose model Calif used, called the discovery 'one of the most impactful security issues in recent memory.' Cloudflare’s chief technology officer, Dane Knecht, described the company’s emergency firewall rules as a 'STOPGAP only.'
In Finland, one of the most digitized countries in the world, the government’s public websites were temporarily shut down, disrupting basic tasks. Many organizations took their websites down as an emergency precaution while they fixed the flaw, which was identified using artificial intelligence.
What's confirmed
- PHP programmers released a fix Wednesday, and the U.S. National Security Agency told organizations to patch their sites immediately or pull vulnerable systems offline, a call echoed by authorities from Japan to the European Union.
- The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell”, can let an attacker take control of a web server without logging in.
What's still developing
- “They may run a website using PHP but don’t really keep a close eye on it,” he said.
- OpenAI said the discovery "marks a new phase, where AI can find security bugs with internet-scale impact."
- Read next: AI-powered cyberattacks are forcing RIAs to rethink client security Few advisors will ever touch PHP, but many of their websites run on it.
- In July, attackers went after two chained flaws in WordPress itself, dubbed WP2Shell, which allowed sites to be taken over without a login.
- “It’s in the fabric of our society, a lot of these services,” said Kalle Pusa, 33, a software developer who is involved in Helsinki city politics.
- But the flaw and the temporary shutdowns it provoked showed how far-reaching potential cyberattacks could be — and how deeply the internet has embedded itself into our lives.
- European government websites taken down, major sites like Wikipedia affected This story is developing and will be updated.
- Counterparts in the US, UK, Australia and the European Union went further, telling organizations to take systems offline if they couldn’t patch right away.
- Canadian advisory firms whose websites, client portals or vendors depend on the software are caught up in it.
- Security firm watchTowr says its network of decoy servers has recorded attempts to exploit both flaws, and web security firm Patchstack says it has confirmed several attacks, though it hasn’t published details.