Critical PHP flaws force government websites offline across Europe; update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

Two serious security holes in PHP, the programming language behind a large share of the world’s websites, have been fixed, and several European governments pulled public sites offline while they waited for the patch. The PHP project published the fixes on 21 October and urged every user to update immediately.

What the flaws are

The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on the 10-point CVSS v4 scale, which is the critical band. According to the PHP project’s own advisory, both let an attacker who is not logged in run code on the server remotely. The risk is highest on servers that run PHP through Apache’s mod_php.

• CVE-2026-109618: when the server runs short of memory, PHP can be interrupted while a request’s internal data is only half set up, and the later clean-up then treats that broken data as valid.
• CVE-2026-109619: internal data belonging to one request can survive after its memory is freed, and a later request handled by the same worker may then use it.

Which versions fix it

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any version older than these within those branches is affected. The project says updating is the only complete cure. Configuration tweaks only reduce the exposure. Patches for the source code of PHP 7.4, 8.0 and 8.1 are available, but those versions no longer get updates from the project, so owners should ask their hosting or software vendor about backports.

Sites switched off as a precaution

In the Netherlands, the National Cyber Security Centre (NCSC) took its own website offline and said it was working on a fix. Other Dutch sites followed, including the Tweede Kamer, the government portal Overheid.nl and the Port of Rotterdam. The NCSC said at the time that a public proof-of-concept existed but that it had not yet seen active attacks.

Finland’s state IT provider Valtori took central government web services offline, calling it a precaution. Denmark’s municipal IT company Kombit shut several services, including the national school communication platform. France’s Interior Ministry put all its websites into preventive maintenance.

The scale of the exposure is large. PHP runs roughly 75 per cent of websites whose language can be identified, according to the web-technology survey W3Techs. Scan data from Censys suggests about 1.5 million of 2.6 million hosts it examined were still on a PHP version without the fix.

What site owners should do

• Find out which PHP version your website or hosting runs. Many small sites, including those built on WordPress, use PHP.
• Update to the patched version for your branch, or ask your hosting provider to do so, and restart the PHP workers afterwards.
• If you cannot update at once, the European Union’s cyber emergency team CERT-EU advises temporarily isolating public-facing PHP applications from the network.

Indian site owners face the same risk as anyone else if they run an unpatched PHP version. PHP 8.2 reaches the end of its life on 31 December 2026, so those still on that branch should plan a move to a newer one.