Dutch authorities, Finland’s Valtiolle.fi job-site operator and the European Patent Office (EPO) restricted public services Oct. 21 while cybersecurity bodies warned that two PHP flaws could let attackers run code on exposed servers without logging in.
The European Commission, the European Union Agency for Cybersecurity (ENISA), CERT-EU, Europol EC3 and the EU national CSIRTs network identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Their joint statement said the flaws could enable remote code execution before an attacker authenticates.
ENISA said PHP’s security team made fixes available at 13:40 UTC on Oct. 21. The updates cover versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s advisory warns that installations handling web requests may be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies Apache configurations using mod_php as the highest risk. The PHP project no longer issues updates for version 8.1 or earlier, though vendors may provide backported fixes.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. Its notice reported no signs of active exploitation at the time and said many government sites, including Rijksoverheid.nl, do not use PHP. EconoTimes previously covered the Dutch government’s precautionary website shutdowns.
The EPO said epo.org and several portals went offline on Oct. 21. After patches were installed, it began restoring affected sites in stages. Finland’s Valtiolle.fi job website reported that listings were unavailable while its applicant portals remained open; its operator said the update was completed that day. The Finnish Food Authority said it had closed some services and found no exploits in those systems. In an Oct. 22 update, it said email traffic was working again.
OpenAI said cybersecurity firm Calif used GPT-5.6 Sol to identify one flaw, while Wiz independently found and reported both vulnerabilities. OpenAI said it coordinated disclosure with maintainers, researchers and security providers during the two months before the fixes. PHP’s advisory urges users to install the update for their version.
