Government agencies, businesses, and other organizations worldwide temporarily shut down websites on Wednesday, October 21, following the discovery of two critical security vulnerabilities in PHP, a programming language used by approximately 70% of websites globally. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow hackers to remotely execute malicious commands on vulnerable servers without authorization, potentially exposing sensitive information and giving attackers control over affected systems.
Cybersecurity firm Wiz, which discovered the vulnerabilities through AI-assisted research, warned that the weaknesses could have far-reaching consequences because PHP supports major online platforms and content management systems, including WordPress, Drupal, and Joomla. The US National Security Agency (NSA) and European cybersecurity authorities urged organizations to immediately install newly released security patches or temporarily disconnect vulnerable systems when updates could not be applied. Several government and public-service websites across Europe were taken offline as a precaution while administrators assessed their exposure and implemented protective measures.
The emergency underscores how vulnerabilities in widely used software can disrupt essential online services across multiple countries. However, the discovery does not mean that 70% of websites have been hacked, nor does it establish that every website using PHP is equally exposed. The immediate concern involves servers running affected PHP versions and configurations, particularly those accessible through the internet. With security updates released on October 21, organizations are being advised to identify vulnerable installations, apply patches, and monitor for suspicious activity as cybersecurity teams assess the possibility of further attacks.