Government Sites Forced Offline as 9.2 Severity PHP Flaws Trigger Patch
Government websites across Europe went offline on October 21, 2026, following the emergency disclosure of two critical security flaws in the PHP programming language. System administrators, enterprise IT teams, and hosting providers are scrambling to deploy software updates to prevent unauthenticated attackers from gaining remote code execution on backend servers.
Fixes land for versions 8.2 through 8.5 as NSA warns of total server takeover
The vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, carry a 9.2 severity rating under version 4 of the Common Vulnerability Scoring System. The UK National Cyber Security Centre confirmed that both flaws trigger memory corruption during request handling, enabling attackers to execute arbitrary code without logging in. Apache setups running mod_php face the highest risk because malicious requests can trigger the exploit before any application code executes, though PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed installations are also exposed. Official security fixes are available in PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. US NSA Cybersecurity urged organizations unable to apply the update immediately to consider disconnecting affected systems from the network to protect internal databases and file structures.
The widespread infrastructure disruption highlights the foundational risk to backend systems relying on PHP, where legacy releases such as PHP 8.1 and older no longer receive direct security maintenance from the core development project.
