PHP developers say key patches available after global scare

The updates patching the recently leaked PHP security issues are now online, developers of the open-source programming language said on Wednesday afternoon.

"All PHP users are strongly encouraged to update immediately," the team said in an online statement.

Millions of websites worldwide, including critical infrastructure and government portals, as well as news sites and online shops, rely on PHP. The software is free.

The new patches aim to fix two "critical vulnerabilities" hackers could exploit to remotely take control of websites and servers, bypassing usual obstacles such as password-protected accounts. The gaps were labeled CVE-2026-109618 and CVE-2026-109619.

By exploiting them, malicious actors could gain access to government databases and customer data, deface websites, or compromise entire businesses or other online services.

"If you run PHP, it is imperative that you update now," the PHP Foundation said in a blog post.

Cloudflare reports 'early attacks'

The weaknesses were flagged by two separate security companies, Calif and Wiz, this August. Both of the firms used AI tools to detect the PHP issues.

PHP developers kept the flaws confidential while working on the fix. News of the security issues, however, leaked on Tuesday, a day before the scheduled update.

Hours before the PHP update, Dane Knecht, the chief technology officer of security firm Cloudflare, said hackers were already trying to exploit these weaknesses.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," he said in an online post.

The Wikimedia Foundation, which runs Wikipedia, said it was addressing the security vulnerabilities.

"We have taken down a number of other systems as a precautionary measure until they can be safely patched," it said.

NSA urges taking websites offline if update not feasible

Authorities in multiple countries, including Australia, Japan, and several European nations, issued warnings and took down government websites in an effort to preempt potential attacks.

In France, the website of the Paris Police Prefecture was taken offline due to "detection of a critical security vulnerability," along with local government pages. Germany's government IT service took down some sites that used PHP. Belgium's Foreign Ministry temporarily blocked its own online presence, while the Dutch cybersecurity agency took itself online as a precaution.

The US National Security Agency (NSA) warned that vulnerabilities "often provide a direct path to the server's file system or database."

"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated," they said on X.

Meanwhile, the White House said it was informed of the issue last week and that US federal agencies were assessing the potential impact to government systems and infrastructure.