Serious PHP Vulnerability Forces Emergency Shutdown of Government Websites in Multiple European Countries
The PHP team confirmed two serious remote code execution vulnerabilities on Tuesday, and after releasing a patch on Wednesday, many European governments proactively shut down a large number of public service websites.
The Dutch Parliament website Tweede Kamer, digital identity system DigiD, government portal MijnOverheid, National Cyber Security Centre NCSC, and the Port of Rotterdam's official website have all been temporarily taken offline. Finland's government IT center Valtori cut off all publicly facing government internet services starting at 12:45 local time, while the Belgian Flemish government website and several university systems took similar measures simultaneously.
The vulnerabilities, numbered CVE-2026-109618 and CVE-2026-109619, both received a CVSS v4.0 score of 9.2, allowing attackers to execute arbitrary code on servers without logging in. The impact covers PHP versions 5 and above, with the official patch only covering branches 8.2 to 8.5. Older versions are no longer supported and have no official fixes.
Cloudflare reported observing early attack traffic before the patch was released and deployed temporary WAF rules for all its customers as a transitional protection measure. Security agencies CERT-EU, the UK's NCSC, and Australia's ACSC have all advised organizations unable to patch immediately to isolate or take down relevant systems.
According to W3Techs, about 69% of websites using identifiable server-side languages use PHP, with WordPress alone powering about 40% of websites globally. This incident directly affects several hospitals, political party websites, universities, and transportation service platforms in the Netherlands.
Security vendors and CDN providers are handling emergency traffic through WAF rules and managed protection, forcing website operators to choose between downtime costs and invasion risks. Unupdated PHP 7 and earlier environments are under the most pressure, with attackers probing unprotected instances.
Source: Public Information
ABAB AI Insight
The PHP core team announced the vulnerabilities on October 20, 2026, and released an emergency patch the following day. This timeline is similar to the handling of remote code execution issues that occurred in the PHP 7 series in 2019, where attackers also exploited unupdated instances during the patch window, ultimately prompting some hosting providers to enforce upgrades for their customers.
Cloudflare deployed WAF rules within hours of the vulnerability information leak, covering both free and paid customers, while Wiz and other security companies participated in coordinating disclosures. Resources quickly shifted from vulnerability research to the temporary incremental demand for protection products and managed services, while many government and small to medium enterprise systems still running PHP 7 and earlier versions face upgrade costs or shutdown decisions.
Similar to the 2021 Log4Shell incident, this vulnerability affects widely deployed application stacks like WordPress, Drupal, and Magento through a single foundational component. The industry is currently in a phase of attack surface control, with security vendors competing for market share through rule updates, while traditional PHP applications are accelerating their migration to supported versions or alternative stacks.
This essentially represents a restructuring of the industry chain: the mismatch between long-term support policies for core languages and large-scale legacy deployments is amplified after information leaks, forcing dependent parties to adjust their infrastructure in a short time, while protection layer suppliers gain temporary pricing and bundling opportunities.
ABAB News · Cognitive Laws
Once the foundational component is compromised, all upper-level applications stop.
Before the patch arrives, downtime comes first.
The higher the proportion of legacy systems, the steeper the emergency costs.