The PHP project released fixes for two critical remote-code-execution flaws on Oct. 21, after Dutch officials took several public-service sites offline and operators faced potential exposure across a widely used web language.
The Dutch government listed Overheid.nl, MijnOverheid.nl and DigiD among the sites taken offline, but did not give a total. It said it had no signs of active exploitation when it issued its statement and that Rijksoverheid.nl, its information site, does not use PHP. Yle separately reported that Finland's Government ICT Centre, Valtori, began taking public internet services offline as a precaution; Yle said Valtori did not identify the affected services.
PHP identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Both received a 9.2 rating under version 4.0 of the Common Vulnerability Scoring System. The project released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory says installations processing web requests may be affected and that interim measures cannot fully secure them; operators need to apply an update for complete remediation.
Cloudflare said it detected traffic directed at customers and that attackers altered exploit payloads in efforts to evade its defenses. The company did not report that those attempts resulted in customer compromises.
OpenAI said Calif found a critical flaw with GPT-5.6 Sol and that Wiz independently found and reported both vulnerabilities. Wiz said its researchers used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, identifying the first flaw Aug. 19 and reporting the vulnerabilities to PHP Aug. 24. OpenAI said its available evidence indicated frontier AI found the flaws before attackers did.
W3Techs put PHP's share at 69.3% among websites where it could identify the server-side language. Wiz says PHP supports platforms such as WordPress, Drupal and MediaWiki; the vulnerabilities were in PHP's core code, rather than those platforms' own software.
The PHP Foundation linked the defects to internal routines for memory handling and error processing. It said changes to those components can affect compatibility, performance and third-party extensions. PHP said it no longer provides regular project updates for version 8.1 and older, though it supplied limited source-code backports for versions 7.4, 8.0 and 8.1. Some distributions and long-term-support vendors may also offer patched packages; the project previously issued source-code backports for older PHP releases.
A joint statement from the European Commission, the European Union Agency for Cybersecurity (ENISA), CERT-EU, Europol EC3 and the CSIRTs network advised operators who cannot apply fixes immediately to isolate exposed applications from public networks until updates are available.
