The emergency prompted precautionary outages affecting public services in the Netherlands, Finland, France and Germany, while PHP developers released security updates and urged operators to install them immediately. Cybersecurity authorities warned that vulnerable servers could allow attackers to execute malicious code without authentication.
The European Union Agency for Cybersecurity, ENISA, joined the European Commission, CERT-EU and Europol’s European Cybercrime Centre in issuing an urgent warning. Their joint statement identified the flaws as CVE-2026-109618 and CVE-2026-109619 and confirmed that fixes became available on Wednesday at 13:40 UTC.
The agencies instructed organisations to identify affected applications, coordinate with hosting providers and prioritise internet-facing systems. Websites unable to install patches promptly were advised to consider temporary isolation from public networks rather than leave exposed servers accessible.
The Dutch government confirmed that several official websites had been deliberately disabled, including Overheid. nl, MijnOverheid. nl and DigiD, a digital identification service used to access public administration. Its statement said the closures were precautionary and that authorities had not identified evidence of active exploitation at the time of publication.
France’s Interior Ministry temporarily disabled websites operated by prefectures, the local administrative offices representing central government. Officials said the decision would remain in place while they awaited a security correction for the framework supporting those services.
Germany’s federal information technology provider ITZBund also disconnected several government websites. A digital ministry spokesperson said the action was preventive and that no security incidents had been identified. Finland’s government websites experienced partial or complete disruption as administrators worked to address the risk.
The interruptions extended beyond central government services, with schools, hospitals and other organisations taking protective measures. The scale of disruption illustrated the operational consequences of a vulnerability affecting software embedded in public-facing systems, even before individual organisations had established whether attackers had compromised them.
The vulnerabilities were uncovered with assistance from artificial intelligence tools. OpenAI said cybersecurity company Calif identified a critical flaw using its GPT-5.6 Sol model, while security company Wiz independently discovered and disclosed both weaknesses. PHP maintainers coordinated the corrections with researchers and infrastructure providers over approximately two months.
OpenAI said the work involved Cloudflare and other partners preparing protections before the public disclosure. The company described the collaboration as an effort to give website operators time to secure systems while limiting the opportunity for attackers to exploit newly disclosed weaknesses.
The two vulnerabilities carry severity scores of 9.2 out of 10. NHS England’s cybersecurity advisory said exploitation could permit unauthenticated remote code execution or access to sensitive information held in server memory. It identified fixed releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Older versions, including PHP 8.1 and earlier, are no longer supported by the PHP project and require migration to maintained software rather than reliance on ordinary security updates. Administrators were also told to check applications and equipment incorporating PHP indirectly, since the language may be present even where it is not immediately visible.
The United States National Security Agency warned that such weaknesses could expose server file systems and databases. It advised organisations unable to update immediately to take affected systems offline until adequate protections could be implemented.
Britain’s National Cyber Security Centre similarly urged operators to identify PHP installations, monitor publicly accessible systems for suspicious activity and follow updates from third-party vendors. Singapore and Canada issued alerts directing organisations to patch exposed systems without delay.
PHP is used behind the scenes to generate web pages, process requests and interact with databases. It is incorporated into widely deployed content management platforms, including WordPress, Drupal and Joomla, making the security response relevant to organisations far beyond government departments.
Cloud. gov, the United States government hosting platform, instructed customers using PHP buildpacks or custom container images to deploy patched software. Its administrators said they were monitoring the platform for indications of compromise while preparing updated deployment guidance.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
