A pair of critical PHP flaws led the Dutch government and European Patent Office to take public services offline Oct. 21 because the bugs could let attackers run code on exposed servers without logging in.
The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among the sites it took offline. The European Patent Office said epo.org and several online portals were also disabled; after installing patches, it began restoring affected services.
PHP is an open-source web language that runs on servers and can assemble pages before they reach visitors’ browsers. W3Techs’ Oct. 22 figures put PHP on 69.3% of sites for which it could identify a server-side language. WordPress, which is built on PHP, accounted for 39.6% of all websites, the tracker said.
The bugs affect PHP’s handling of memory. CVE-2026-109618 can corrupt memory when PHP handles an out-of-memory condition; CVE-2026-109619 can leave stale internal state available after memory has been freed. Each received a 9.2 out of 10 rating under CVSS v4.0 and could enable remote code execution without authentication.
PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. CERT-EU advised organizations to update affected installations, or to isolate internet-facing applications from public networks if they could not install and verify a fix. The PHP development team said, “There are no complete mitigations, updating is the only safe choice.”
OpenAI said security firm Calif used GPT-5.6 Sol to identify a critical PHP flaw. Wiz separately said its researchers found and reported vulnerabilities to PHP; the firm said AI tools helped demonstrate how long-standing weaknesses could be exploited.
When it issued its notice, the Dutch government said it had no indication that attackers were exploiting the flaws. CERT-EU later reported that code demonstrating potential attacks was circulating, which increased its assessment of the risk; it did not confirm a successful intrusion. CERT-EU advised operators who cannot apply and verify a patch to keep internet-facing applications isolated from public networks.
