Government websites across Europe were temporarily taken offline on Wednesday as administrators rushed to address two critical security vulnerabilities in PHP, one of the world’s most widely used web programming languages.

The precautionary shutdowns followed warnings from European cybersecurity authorities that the vulnerabilities could allow attackers to remotely execute malicious code on vulnerable servers without needing a password or user account.

The PHP development team released emergency security patches on October 21, while the European Union Agency for Cybersecurity (ENISA), CERT-EU and other European authorities urged organizations to install the updates immediately.

Organizations unable to apply the fixes were advised to consider temporarily disconnecting vulnerable systems from the internet to prevent potential attacks.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

— FBI Cyber Division (@FBICyberDiv) October 21, 2026

What is PHP and why does it affect millions of websites?

PHP is a programming language used to power websites and web applications, operating behind the scenes without visitors necessarily being aware of it.

When someone opens a website, a server running PHP can process information, retrieve content from databases and assemble the webpage before sending it to the visitor’s browser.

PHP is open-source software, meaning it is freely available and maintained by a community of developers.

According to web technology monitoring company W3Techs, PHP is used by nearly 70% of websites whose server-side programming language is known.

It also powers WordPress, the popular content management system used by approximately 40% of websites worldwide.

As a result, vulnerabilities in PHP can potentially affect an enormous range of online services, from personal blogs and small business websites to government portals, online stores and major news organizations.

The widespread use of PHP makes it a fundamental part of the internet’s infrastructure, meaning security problems affecting the language can have consequences far beyond individual websites.

🚨 Do you understand what happened in the last 48 hours.. > PHP, the code behind 69% of all websites, got 2 holes rated 9.2 out of 10, and the US, the UK and Japan told site owners to patch or go OFFLINE.. 4 days after hackers had already started trying the flaw.. > Japan’s Prime Minister posted the request late at night.. the Finance and Health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut ALL Desktop Cloud plans after malware hit up to 26,739 customer servers.. > India’s eMudhra was caught with 8 intermediate certificate keys so weak one of them was literally the number 4.. the 60,000,000+ certificates it has issued can’t be trusted.. > GitLab disclosed a 10.0 severity hole in every version since 2014.. the maximum score there is.. > criminals were caught using a literal AI hacking tool on 1,200+ sites.. it broke into more than 100 companies including John Deere and Cummins.. > LiteLLM, an AI tool with about 23,000,000 downloads a week, was secretly poisoned with a password stealer.. the bad version sat on PyPI for about 2 hours.. > State Bank of India, the country’s biggest bank, confirmed 3,897 customer records on the dark web.. > WIRED now calls the PHP flaw "broadly exploited".. nearly 55,000,000 web properties still run PHP.. every single government on this list told PHP site owners the same thing within the last 48 hours.. patch it or take it offline.. all of this.. 48 hours.. if you’re not following me you’re finding out about this 48 hours late from someone who read my post.. it’s only getting crazier from here..

— Taegun Lee (@TGLetter) October 22, 2026

How dangerous are the two security vulnerabilities?

Both vulnerabilities received a severity rating of 9.2 out of 10 under the CVSS 4.0 system, a widely used standard for assessing cybersecurity threats.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could enable what cybersecurity experts call unauthenticated remote code execution.

In practical terms, this means a hacker could potentially run commands on a vulnerable server over the internet without first obtaining login credentials.

Successful exploitation could allow attackers to steal sensitive information, manipulate website content or compromise entire systems.

The risks are particularly significant because PHP powers millions of websites, allowing vulnerabilities in its underlying software to potentially expose large numbers of systems simultaneously.

The PHP security team said installations handling web requests were at risk, with particularly serious exposure identified in certain Apache server configurations.

The emergency fixes were released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Developers emphasized that installing the updates was essential because other protective measures could not completely eliminate the vulnerabilities.

Why smaller websites face particular risks

Smaller websites may be especially vulnerable because their owners frequently lack dedicated cybersecurity teams or the technical expertise needed to respond quickly to critical security alerts.

Many websites also operate on shared hosting platforms, where responsibility for maintaining PHP installations may rest with external providers rather than individual website operators.

This can create confusion about who is responsible for installing updates and whether vulnerable software has already been replaced.

Wordfence, a company known for its WordPress security software, warned about the importance of addressing vulnerabilities at the server level.

Crucially, updating WordPress plugins or the WordPress platform itself does not automatically update PHP.

The WordPress project confirmed that the newly disclosed vulnerabilities were not specific to WordPress and that no WordPress software update was required to resolve them.

Instead, website owners were urged to check which PHP version their hosting providers were running and ensure that the relevant security patches had been installed.

How artificial intelligence helped uncover the security flaws

One of the most striking aspects of the incident is the role advanced artificial intelligence systems played in discovering the vulnerabilities.

Researchers at cybersecurity company Calif, working with OpenAI, identified a critical flaw using the GPT-5.6 Sol model.

The vulnerability was reported to PHP’s developers on August 11.

Separately, cybersecurity company Wiz, part of Google’s parent company Alphabet, independently discovered the vulnerabilities using AI-assisted research and reported a second security flaw on August 24.

According to the researchers, the weaknesses had existed in PHP’s code for decades. However, demonstrating that attackers could exploit them required an exceptionally complex sequence of technical steps.

Wiz described the discoveries as among the most significant vulnerabilities ever identified in PHP, potentially placing them among the most consequential software security findings.

The complexity of the exploits highlights the growing importance of AI in cybersecurity research.

Advanced AI models can analyze extensive software codebases, identify unusual patterns and help researchers investigate weaknesses that might otherwise remain undiscovered for years.

In an October 21 statement, OpenAI said it had coordinated with PHP maintainers and cybersecurity partners, including Wiz and Cloudflare, to help prepare fixes and protective measures before the vulnerabilities became public.

Trump administration responds to the cybersecurity threat

The severity of the incident also prompted a response from the administration of US President Donald Trump.

The administration said it was monitoring developments and coordinating with federal agencies and leading artificial intelligence laboratories to help accelerate the release of security fixes.

The White House presented the AI-assisted discoveries as evidence that advanced American artificial intelligence capabilities, described by Trump as “Super Intelligence,” could contribute to strengthening national security.

The developments also demonstrated how AI is changing the cybersecurity landscape, providing researchers with increasingly powerful tools for identifying weaknesses while raising concerns that similar capabilities could eventually be exploited by malicious actors.

Emergency patches released as organizations race to secure systems

The PHP development team released security updates on Wednesday, October 21, addressing both critical vulnerabilities.

European cybersecurity authorities urged organizations to prioritize systems exposed to the public internet and work closely with hosting providers to ensure the necessary updates were installed.

The response extended beyond government websites, with educational institutions, hospitals and other organisations taking precautionary action to protect their systems.

European countries reporting disruptions included Germany, France, Belgium, the Netherlands, Finland and the Czech Republic.

Although the precautionary shutdowns disrupted access to some services, they were intended to prevent potentially more serious consequences from cyberattacks.

For website operators, the immediate priority is to install the patched PHP versions, verify that their servers are protected and avoid exposing vulnerable systems to the internet until the necessary security measures are in place.

The incident underscores the fragility of an interconnected digital ecosystem in which vulnerabilities in a single widely used programming language can create security risks for millions of websites worldwide.