The Netherlands’ National Cyber Security Centre (NCSC-NL) took its website offline amid a response to two critical PHP flaws, illustrating how software weaknesses can disrupt individual services without a global blackout.
The PHP Development Team’s Oct. 21 release patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities could let an attacker run code on an affected server without first signing in. The team said, “There are no complete mitigations, updating is the only safe choice.” It warned that servers using PHP to handle web requests could be at risk.
W3Techs’ Oct. 30 estimate put PHP on 69.2% of sites in its sample with an identifiable server-side language. NCSC-NL said its website was temporarily taken out of service during the response and that other organizations, including government agencies, had also made their sites inaccessible.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said no exploitation had come to its attention as of its Oct. 21 advisory. On Oct. 26, it listed CVE-2026-109618 and CVE-2026-109619 in its Known Exploited Vulnerabilities catalog.
The episode concerns individual website access, not a reported failure of internet routing. The Internet Society describes internet routing as distributed across independently run networks, a structure that supports resilience. Mahmoud Elkhodr, a senior lecturer in information and communication technologies at CQUniversity Australia, argued in a Channel NewsAsia commentary that the internet’s structure makes a total outage improbable. He used a shared sign-in service as a hypothetical example of how access to several platforms could be interrupted; he did not report such an outage.
The Australian Signals Directorate’s Australian Cyber Security Centre said in its 2025-26 report that AI could shorten the time between public disclosure of a software flaw and attempts to exploit it, as the tools reduce the specialized work involved. OpenAI said Calif identified one critical PHP flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz independently discovered and reported both flaws, while PHP maintainers led the fixes.
Operators must identify affected installations and apply updates, while users may lose access during shutdowns. The PHP project says version 8.2 reaches end of life Dec. 31, 2026, after which the project will no longer provide security fixes for that branch.
