Government websites in Europe and elsewhere went offline after a pair of critical PHP vulnerabilities were disclosed on October 21, 2026, Krebs on Security reported.
Key points
- Nearly 70 percent of websites need core software updates to fix critical PHP vulnerabilities.
- Government websites in Europe and elsewhere went offline following the vulnerability disclosure.
- Cloudflare implemented firewall rules at 3:02 am UTC to protect websites from attack traffic.
- Every PHP version released in the last decade is affected by at least one of the vulnerabilities.
Nearly 70 percent of websites need to update their core software to fix the two vulnerabilities, which allow attackers to seize full control over affected servers. Experts warned that working exploits for the flaws are already being used in the wild.
The flaws affect PHP, the programming language powering sites on platforms including Drupal, Magento, Joomla, and WordPress. PHP released an emergency security update earlier today to fix the two critical bugs.
By the numbers
- websites needing core software updates to fix PHP flaws
- 70 percent
- UTC time Cloudflare implemented web application firewall rules
- 3:02 am
Cloudflare stated it detected exploitation of the flaw and implemented web application firewall rules at 3:02 am UTC to protect websites. OpenAI, which participated in vulnerability research and outreach, described the issue as one of the most impactful security events in recent memory due to its severity and PHP's widespread use.
Wiz security experts noted that every PHP version released in the last decade is affected by at least one vulnerability. Researchers at Wiz, credited with discovering the bugs alongside other organizations, stated that the underlying flaws had been present for decades.
“given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”
Sources and references
Original report
Widespread PHP Flaw May Cause Many Site Outages Today
Krebs on Security
Read on Krebs on Security (opens in a new tab)Linked in the original report
- Linkphp.net/index.php (opens in a new tab)
- Linkreuters.com/world/asia-pacific/eu-agency-warns-webs… (opens in a new tab)
- Linkblog.cloudflare.com/php-vulnerabilities-waf-protection (opens in a new tab)
- Linkopenai.com/index/coordinated-disclosure-of-critica… (opens in a new tab)
- Linkwiz.io/blog/php2shell-php-rce (opens in a new tab)
- Officialnvd.nist.gov/vuln/detail/cve-2026-109618 (opens in a new tab)
Ref 0051OQR6
Cite this
APA
Interestana AI Editorial. (2026, October 21). Critical PHP Flaws Threaten Websites Worldwide With Outages. Interestana. https://interestana.com/articles/widespread-php-flaw-may-cause-many-site-outages-today-0051oqr6
MLA
“Critical PHP Flaws Threaten Websites Worldwide With Outages.” Interestana, 21 Oct. 2026, interestana.com/articles/widespread-php-flaw-may-cause-many-site-outages-today-0051oqr6.
Chicago
Interestana AI Editorial. “Critical PHP Flaws Threaten Websites Worldwide With Outages.” Interestana, October 21, 2026. https://interestana.com/articles/widespread-php-flaw-may-cause-many-site-outages-today-0051oqr6.
BibTeX
@misc{interestana_0051oqr6,
author = {{Interestana AI Editorial}},
title = {{Critical PHP Flaws Threaten Websites Worldwide With Outages}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/widespread-php-flaw-may-cause-many-site-outages-today-0051oqr6},
note = {Summary of reporting by Krebs on Security, https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/}
}Credit the source
Original reporting: Krebs on Security, “Widespread PHP Flaw May Cause Many Site Outages Today”, https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe