Officials across Europe took sites offline this week after two critical flaws were found in PHP, software that runs a huge part of the internet. But relax, fixes are now available.
On Wednesday, people across Europe tried to visit government websites and found that some of them were out of action. Also in France, visitors were told that the sites were under "ongoing maintenance." Websites linked to the French, Danish, Finnish and Dutch governments all appeared to go offline as organisations fought to protect their systems.
The cause was a PHP security vulnerability in a programming language that helps run a large part of the web. Officials around the world warned that anyone using PHP should update immediately or take their sites offline until they could solve the possible issues.
So, what happened on Wednesday?
Sky News reported that government and business websites across Europe were taken down after a critical software update was issued over a weakness in the programming language. This description took different forms in different places:
- In Denmark, municipal IT company Kombit shut down several services, including the national school communication platform.
- In the Netherlands, several organisations took their public-facing websites offline.
- In Finland, the government temporarily shut down public web services, leaving parts of official websites unavailable.
The warning spread beyond Europe. Cybersecurity agencies in Britain and Japan urged PHP users to update immediately or take websites offline until patches could be applied.
Japan's Prime Minister, Sanae Takaichi, urged organisations and individuals to check whether their publicly accessible websites use PHP.
Not a hack, but a weakness
Sky's science and technology editor, Tom Clarke, stressed that this was not an attack on those websites. He said the shutdowns were "not because of the hack." Instead, cybersecurity companies discovered a weakness, and national agencies shared the warning around the world.
Clark said the weakness is so widespread that it affects government websites and many businesses too. He described PHP as an old language that is deeply built into the internet, which is why governments in several countries reacted at the same time.
What is PHP?
The UK's National Cyber Security Centre (NCSC) explains that PHP runs on a web server. It generates the content of web pages, talks to databases, and handles the behind-the-scenes logic of applications. It is also used in a range of other products. You may be relying on PHP every day without knowing it.
What are the two flaws?
The NCSC published its alerts on a critical security issue affecting PHP on 21 October. It says the PHP security update fixes a critical issue that may allow attackers to run commands on any web server using PHP.
The two flaws are named CVE-2026-109618 and CVE-2026-109619. A CVE is simply an official ID number for a known security problem. The NCSC describes them in these terms:
- CVE-2026-109618: if PHP runs out of memory at the wrong moment, it can be interrupted while handling a request that is only partly set up. When PHP cleans up afterwards, it treats that unfinished data as if it were fine.
- CVE-2026-109619: information belonging to one request can stay around after the memory behind it has been freed. A later request handled by the same worker may then use that leftover information.
In technical terms, this is a PHP remote code execution vulnerability. The NCSC says an attacker could trigger memory corruption, and under certain conditions, this could be used for unauthorized remote code execution. The full PHP security advisoryfrom the PHP team gives more detail, and the NCSC links to it. The NCSC confirms that the issue has now been fixed.
How big is the risk?
For affected PHP versions, the NCSC is clear: organisations using any version of PHP are affected, and those on older versions should move to one that is fully supported.
The BBC reported that one company estimated roughly 70% of the internet could be affected. The BBC also said that it could not verify that figure independently, so it is best treated as an estimate.
The BBC also noted that Edinburgh council's website and some BBC programme pages became inaccessible. Neither organisation had confirmed whether this was linked to the PHP flaws.
Don Smith, a specialist at the Sophos Counter Threat Unit, said the flaws would likely be a priority target for attackers. Attackers are likely to look for sites that have not been updated.
What about the UK?
According to Clarke, UK government websites are not directly affected. He said parts of their wider systems will be, such as council websites and small businesses that may need to be updated.
The NCSC says it will continue to monitor for any impact on UK organisations. Anyone worried about the PHP vulnerability 2026 should start by asking their web suppliers whether the update has been applied.
What the NCSC wants organisations to do
The NCSC lists these priority actions:
- Find every system running PHP, starting with those connected to the internet. Don't only check old versions, because all may be affected.
- Watch for updates from software suppliers, including for products that may have PHP built-in.
- Install the latest PHP version and keep checking for future updates.
- Apply the extra hardening steps provided by the PHP team.
- Use the temporary fixes from the PHP team if you can't update yet.
- Consider taking the system offline if you can't apply those fixes, or if doing so would take too long, until it is fully protected.
- Check for a break-in if you can't update or switch the system off straight away. Look for backdoors left by an attacker, and get help from an assured incident response provider if you are unsure.
- Check the list of affected products published by the Dutch cyber agency, NCS-NL, which shows software with a PHP dependency.
The bottom line
The shutdowns show how seriously officials are taking this PHP security vulnerability. Governments were willing to switch off public websites rather than leave them open to attack, and the reason was a weakness rather than a confirmed hack.
The advice is the same everywhere. Find out where PHP is used, install the
PHP security patch, and if you can't, take the system offline until you can.
