Two Critical PHP Vulnerabilities Expose Over 70% of Websites—Governments Suspend Services to Implement Fixes

Discovery of Two Severe Security Flaws in PHP

According to НВ — Техно: On October 22, 2026, two critical security vulnerabilities were uncovered in PHP, a programming language powering approximately 70% of websites worldwide, including many government and commercial platforms. These flaws received a high severity rating of 9.2 out of 10 on the CVSS 4.0 scale. In response, several European governments have temporarily taken down online services to apply necessary security updates and protect their infrastructure.

The U.S. National Security Agency advised organizations to disable affected systems if immediate patches cannot be deployed. Exploiting these vulnerabilities could allow attackers unauthorized access to server file systems or databases. Meanwhile, the UK's National Cyber Security Centre urged administrators to audit their systems for any hidden backdoors or unauthorized access mechanisms.

Countries Impacted by the Security Measures

Security precautions have impacted several European nations, including:

• France
• Netherlands
• Finland
• Denmark
• Czech Republic
• United Kingdom

In France, key government websites like the Ministry of the Interior were temporarily placed in maintenance mode. The Netherlands saw the national digital identity system and parliamentary site go offline. Finland shut down its government online services for security reasons, while Denmark paused several platforms, including an information-sharing service used by schools. The Czech Republic experienced website disruptions, and in the UK, municipal websites in Edinburgh, Bristol, and Oxford were temporarily disabled.

Leading tech firms and security researchers, such as OpenAI, Calif, and Wiz, are actively addressing these vulnerabilities. Calif initially identified the issues using a large language model on August 1. Wiz, an Alphabet subsidiary, is leveraging AI tools to detect code weaknesses. Amazon’s Chief Security Officer, CJ Moses, reported an attempted exploit of these vulnerabilities caught in a honeypot on October 17, just days before the public disclosure.

“An attempt to exploit these vulnerabilities was detected on October 17 within our honeypot system-four days prior to the public announcement.” – CJ Moses

Experts strongly recommend promptly applying patches and thoroughly inspecting servers for any signs of compromise. These vulnerabilities may have existed in PHP codebases for over a decade, and the release of fixes introduces heightened risk for systems that remain unpatched.

This incident highlights the critical importance of timely software updates, especially for platforms handling sensitive data. Given PHP’s widespread use, the fallout could affect millions of users globally. Organizations must prioritize safeguarding their systems to prevent future cyberattacks.

As governments scramble to secure their online services, it's crucial to remember that security vulnerabilities are not limited to PHP. Recently, Apple addressed a serious security issue in its software that posed risks to user data across multiple devices. Understanding these threats can help organizations bolster their defenses against potential attacks.