Critical PHP flaws prompt temporary website shutdowns across Europe
Two critical security flaws in PHP have prompted government agencies across Europe to temporarily take their websites offline, Reuters reported on Oct. 21. The disruptions also affected websites operated by schools, hospitals, and other organizations in the Netherlands, Germany, France, Belgium, and Finland.
Two critical security flaws in PHP have prompted government agencies across Europe to temporarily take their websites offline, Reuters reported on Oct. 21. The disruptions also affected websites operated by schools, hospitals, and other organizations in the Netherlands, Germany, France, Belgium, and Finland.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute malicious code on servers without needing login credentials, according to Google Cloud’s security analysis. The Dutch government confirmed that services like DigiD were taken offline as a precaution, but officials said there were no indications of active exploitation.
What to check this week
If you run a business website or internal application, this is a reminder to check your backend software. PHP versions 5.4 through 8.5.11 are affected by these vulnerabilities, the PHP project confirmed. The development team released emergency patches on Oct. 21 to fix the issues.
Here’s what you need to do this week. First, check the PHP version running on your business websites and applications. If you’re on PHP 8.2 through 8.5, update to the fixed versions released on Oct. 21. If you use PHP 8.1 or earlier, check whether your operating system or long-term-support vendor provides backported fixes.
If you use cloud hosting, confirm with your provider whether they have deployed the necessary fixes or if you need to update your own runtime. Review logs for suspicious activity if you suspect your systems were exposed before the patch was applied.
The outages were preventive measures, not evidence that the affected government systems had been breached. But it’s a stark example of how a single software vulnerability can disrupt essential services. Do the boring version of this and you’ll be fine. Check your PHP version. Update it. Move on.
Sources: techrepublic.com.
