PHP issued fixes Wednesday, Oct. 21, for two critical flaws that can enable code execution on web servers; Dutch government shutdowns showed the disruption involved in securing public sites.
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. PHP says installations handling web requests may be affected, with Apache using mod_php the highest-risk setup because an attack can reach vulnerable code before the site’s application runs. The project released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and earlier no longer receive fixes from the project, though some vendors may issue backported patches.
The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. South Holland province later reported that its affected sites were gradually returning after the update became available.
The U.K. National Cyber Security Centre (NCSC) urged operators to review PHP in third-party products and services alongside their own deployments, prioritizing systems reachable from the internet. It advises considering an offline shutdown when temporary mitigations cannot be put in place or would take too long to apply. That leaves operators weighing the work of securing exposed systems against possible service interruptions.
W3Techs reported PHP on 69.3% of websites whose server-side programming language it could identify on Oct. 22; the figure excludes sites without an identifiable language. PHP also supports platforms including WordPress, Drupal, Joomla and MediaWiki, so a site can be at risk from its PHP runtime even if its own application has no defect. Wiz invoked Heartbleed and Log4Shell as comparisons for the potential reach of a flaw in widely used software, not as claims that the incidents are equivalent.
OpenAI said Calif identified one flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. Amazon said its threat-intelligence team detected an exploit attempt on a honeypot Oct. 17, followed by further attempts against honeypots Oct. 21. Amazon said the first attempt’s data could not establish whether a live system would have been compromised.
The PHP Foundation said an early warning sign for one flaw emerged in 2024, before researchers had found a workable attack method. It later called the delay in resolving the issue a ‘structural failure,’ citing the security team’s decision process and limited resources. The NCSC says operators should watch for updates from vendors and service providers whose products or services include PHP.
