Critical PHP flaws force European websites offline as companies race to patch systems

European governments and companies are racing to secure their digital infrastructure after the disclosure of two critical vulnerabilities in PHP, one of the world's most widely used programming languages for websites and web applications.

The flaws, identified as CVE-2026-109618 and CVE-2026-109619, can potentially allow an unauthenticated attacker to execute malicious code remotely on affected servers, creating risks ranging from data theft and malware installation to the complete compromise or disruption of online services.

Both vulnerabilities received a CVSS severity score of 9.2 out of 10, prompting coordinated warnings from cybersecurity authorities across Europe and beyond.

On Wednesday, the PHP development team released security updates for supported versions of the software and urged users to install them immediately. The new releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

PHP's security team warned that there are no complete alternative mitigations and described updating as the only safe solution for affected installations serving web requests.

The incident is particularly significant because PHP remains deeply embedded in the architecture of the internet. It is used to generate dynamic webpages, communicate with databases and process backend operations, and underpins large numbers of websites built with platforms such as WordPress, Drupal, Joomla and Magento.

European agencies urged organisations to disconnect vulnerable systems

The UK's National Cyber Security Centre (NCSC) called on organisations to identify systems running PHP, prioritise internet-facing infrastructure and install updates as soon as they became available.

Where immediate remediation was impossible, the agency advised organisations to consider taking affected systems offline until they could be secured.

The Computer Emergency Response Team for EU institutions, bodies and agencies (CERT-EU) issued similar guidance, recommending that internet-facing applications be isolated from public networks when immediate patching was not possible.

That advice quickly translated into real-world disruption.

In the Netherlands, several public-sector websites were temporarily shut down as a precaution, including MijnOverheid.nl, the country's digital government portal, and DigiD, the identity system used by Dutch citizens to access public services.

The Dutch government's own cybersecurity centre also temporarily took its website offline because of its exposure to the PHP vulnerability. Other government, judicial and municipal online services adopted similar measures.

Amsterdam authorities confirmed that some municipal websites had also been temporarily disabled, although the city's main Amsterdam portal remained operational because it was not affected.

The shutdowns illustrate the difficult calculation confronting organisations when a vulnerability affects underlying infrastructure: keeping a digital service available may preserve business continuity, but leaving an exposed server online before it can be patched can create substantially greater financial and operational risks.

Attack traffic was already being detected

The disclosure became more urgent after cybersecurity infrastructure company Cloudflare said it had observed attack traffic targeting the vulnerabilities.

Cloudflare said the flaws, collectively referred to as php2shell, could potentially enable denial-of-service attacks, remote code execution and data exposure in certain environments.

The company deployed protections through its web application firewall ahead of the public disclosure and said attackers were already modifying malicious payloads in attempts to bypass defensive measures.

According to Cloudflare, its protections were enabled by default for customers using its free and paid WAF services before the vulnerabilities became fully public.

The development highlighted another growing cybersecurity challenge: once details of a major vulnerability become public, the time between disclosure and attempted exploitation can be extremely short.

While some national cybersecurity authorities said they had not initially observed confirmed exploitation in their own environments, Cloudflare's global network detected malicious traffic targeting customers.

A problem extending beyond company websites

For businesses, the challenge is not limited to checking whether their corporate website visibly runs on PHP.

The programming language can be embedded within web applications, e-commerce platforms, control panels, appliances and third-party services, meaning companies may also depend on software vendors to distribute their own updated versions after incorporating the PHP patches.

The UK's NCSC therefore recommended that organisations continue monitoring security notices from third-party providers even after updating systems they manage directly.

Older PHP installations represent a particular concern.

European authorities initially warned that versions dating back to the PHP 5 generation could potentially be affected. However, the PHP project issued fixes for currently supported branches, meaning organisations running obsolete systems may need to upgrade the underlying software rather than simply apply a routine security patch.

For large organisations with hundreds or thousands of applications, identifying every system that contains a vulnerable dependency can itself become a significant operational task.

The incident therefore provides another reminder of the business risks associated with legacy technology and unsupported software. Systems that remain functional for years can become expensive liabilities when a critical security flaw emerges and no straightforward patch exists.

Cybersecurity becomes a business continuity issue

The PHP vulnerabilities arrive as European companies and public administrations become increasingly dependent on digital infrastructure for transactions, identification, customer services and internal operations.

A remotely exploitable flaw in a widely deployed web technology can therefore move rapidly from an IT security problem to a business continuity and economic risk.

For organisations capable of patching immediately, the priority is relatively straightforward. The more complicated situation involves companies using legacy software, heavily customised systems or third-party products that cannot be upgraded without testing or operational disruption.

The precautionary shutdown of major Dutch digital services shows the trade-off clearly: organisations may decide that temporary unavailability is preferable to exposing sensitive systems to attackers.

With official security releases now available, European cybersecurity authorities are pushing companies and institutions to move rapidly from emergency mitigation to permanent remediation.

The immediate task is technical, but the broader lesson for European businesses is strategic: understanding which software components sit beneath critical digital services — and ensuring they can be updated quickly — has become part of managing operational risk itself.