tech
Global websites face mass outages due to critical PHP flaws
Global websites face mass outages as cyber agencies warn of critical PHP flaws
Key points
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 for severity.
- The flaws can allow an attacker to take control of a web server without needing to log in.
- PHP developers released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after details leaked online.
Why it matters. The flaws affect PHP, the code behind most of the internet, potentially allowing attackers to take control of web servers.
Global websites, including Nintendo, parts of Wikipedia, and government sites in France, Finland, and the Netherlands, were taken offline following warnings of mass attacks. The Canadian Centre for Cyber Security and other agencies warned of two critical PHP flaws, nicknamed “PHP2Shell,” which could allow attackers to control web servers without logging in. PHP developers released fixes after details leaked online ahead of the planned disclosure date.
Latest updates
Global websites face mass outages due to critical PHP flaws
A wave of international cyberattacks has targeted critical flaws in PHP, the coding language powering a majority of the internet. The attacks have successfully taken several European government websites, portions of Wikipedia, and Nintendo services offline. The Canadian Centre for Cyber Security joined international agencies in alerting the public to the vulnerability. Technical teams are currently working to patch the flaws as the situation develops.
Global websites face outages as critical vulnerabilities emerge in the PHP programming language
International cyber-security agencies have urged website operators worldwide to patch two critical flaws identified in the PHP programming language, which powers a significant portion of the internet. The vulnerabilities have led to temporary outages and emergency maintenance across various government and corporate portals globally. Security experts warn that unpatched systems remain highly vulnerable to remote exploitation by malicious actors. Organizations are advised to apply the newly released updates immediately to secure their web infrastructure against potential attacks.