The PHP project released fixes Oct. 21 for two critical flaws that could let attackers run code on web servers without logging in, as precautionary shutdowns interrupted public services in the Netherlands and Finland.
The flaws, CVE-2026-109618 and CVE-2026-109619, each have a severity score of 9.2 out of 10 under CVSS version 4.0. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP warned that installations handling web requests need attention, particularly those using Apache’s mod_php configuration. It said PHP 8.1 and older no longer receive regular project updates.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. The Finnish Food Authority temporarily closed several services and said it had found no exploitation in them. People trying to use the affected services lost access during the closures.
The Cybersecurity Service for the Union institutions, bodies, offices and agencies (CERT-EU) urged operators to patch affected systems promptly. If administrators cannot apply and verify a fix, CERT-EU said they should consider isolating affected applications from public networks until the fix is applied and verified. The PHP development team said, “There are no complete mitigations, updating is the only safe choice.”
Cloudflare said it observed attack traffic targeting customers. It enabled default firewall protections for customers using its web application firewall. Its report of attack traffic did not establish that a customer had been compromised.
The vulnerabilities involve how PHP handles memory during and between web requests. Changing a website’s content would therefore leave the underlying PHP issue unresolved. The WordPress project said its software needs no update for these flaws and that it has no such release planned.
Website operators should check the PHP version at their host, install a fixed supported release or an appropriate vendor-supplied patch, and verify the fix before restoring any applications they have isolated.
