Websites taken offline as critical PHP flaws trigger urgent updates
Website operators are rushing to update PHP after two critical security flaws prompted warnings from cyber-security agencies, with some services taken offline while fixes are applied.
Website operators are racing to secure systems after two critical vulnerabilities were discovered in PHP, with some websites taken offline, according to the supplied BBC Technology report. The PHP project released fixes on October 21, 2026, and urged users to update immediately because the flaws can allow attackers to execute code without logging in. PHP security advisory
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect the software underlying web applications rather than a single website. CERT-EU assigned each a critical severity score of 9.2 and warned that publicly circulating demonstrations increased the likelihood of exploitation. Its advisory did not establish how many organisations had been compromised. CERT-EU advisory
PHP runs on web servers, generating dynamic pages, interacting with databases and handling application logic before content reaches a browser. It is also incorporated into other software products, meaning organisations may need to check more than their public-facing websites to establish their exposure. UK National Cyber Security Centre
One flaw involves memory corruption when PHP handles an out-of-memory condition. The other concerns internal information remaining accessible after its underlying memory has been freed, potentially allowing a subsequent request to encounter that stale state. Both can lead to unauthenticated remote code execution. CERT-EU advisory
The PHP team identified Apache configurations using mod_php as particularly exposed. It said a demonstrated exploit could trigger an attack before application code starts running, underscoring why protection cannot depend solely on changes within an individual website. PHP security advisory
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators using Linux distribution packages should check their vendors for updates, while those on older, unsupported branches need to establish whether a backported fix is available or move to a supported release. PHP security advisory
WordPress has separately urged site owners to contact their hosting providers and verify their PHP version. The organisation stressed that the vulnerabilities are not specific to WordPress and that no WordPress software update is required or planned to address them; the necessary changes concern the hosting environment. WordPress notice
For organisations unable to patch promptly, CERT-EU recommends considering isolation of internet-facing applications until fixes have been applied and verified. PHP has published temporary measures, but cautions that these reduce exposure to particular attack paths rather than make an unpatched installation safe. CERT-EU advisory
The UK National Cyber Security Centre recommends identifying PHP installations across infrastructure, prioritising exposed systems and checking for evidence of compromise where immediate protection is impossible. It also advises monitoring suppliers of appliances and services that bundle PHP, since those products may require separate updates. NCSC guidance
The response now centres on applying fixes across both directly managed servers and third-party products. The NCSC says it will continue monitoring the impact on UK organisations, while operators are advised to follow subsequent vendor security updates. NCSC guidance
Sources
Primary source: BBC Technology. Newzly rewrites and structures source reporting for clarity; verify critical details at the original.