Critical PHP Leaks: Why Websites Are at Risk Worldwide
The Strategic Newb Editorial Team
Updated:
Translated from the original; figures and sources have been preserved. Read the original →
Updated October 21, 2026. This article describes the situation according to the sources listed below on that date.
A website can temporarily disappear while the administrator is trying to prevent a cyber attack. This is now happening after the discovery of two critical security holes in PHP. The software is used by websites and online applications in different countries. As a result, the problem has an international reach.
The security updates are now available. The most important question for website administrators is therefore whether their hosting provider or technical team has actually implemented the solution. PHP project
What's going on with PHP?
PHP is software that allows servers to execute website code. Visitors usually only see the result: a page, form or online store. The same underlying technology can run behind those visible parts.
The vulnerabilities are registered as CVE-2026-109618 and CVE-2026-109619. Both have a severity score of 9.2 out of 10. According to CERT-EU, under certain circumstances they can allow attackers to execute code without logging in first. This is called remote code execution. CERT-EU
This makes the security of the server important, even when the website itself is well maintained.
Is the PHP problem global?
Yes, the technical risk is global. It is related to software and configurations used, not to national borders. A vulnerable installation can be located at a small company, at an international organization or on a shared hosting platform.
The warnings are also international. CERT-EU published security advice for organizations. The Australian Cyber Security Center also posted a critical warning about PHP. This underlines that this is not an exclusively Dutch incident. CERT-EUAustralian Cyber Security Centre
However, global risk does not mean that the same disruption will occur in every country. Nor does it mean that all websites using PHP have been hacked. The actual consequences depend, among other things, on the vulnerability of an installation and the measures taken.
Why do organizations take websites offline themselves?
A temporarily inaccessible website may be the result of a precautionary measure. CERT-EU recommends updating immediately. When that is not possible, organizations should consider temporarily isolating applications that are accessible from the Internet from public networks. CERT-EU
A concrete example comes from the Netherlands. The National Cyber Security Center reported that it had taken its own website offline as a precaution due to the PHP vulnerabilities. That report confirms a protective measure, not a successful burglary. NCSC Netherlands
The difference may be invisible to users: they see an error message or maintenance page. The difference is essential for the assessment of the incident.
Are attackers already active?
CERT-EU reports that technical details are being discussed publicly and that first demonstrations of abuse are circulating. This increases the chance of actual exploitation. This confirms the urgency, but does not provide a global total of hacked websites. CERT-EU
Three situations must therefore be kept apart:
| Situation | Meaning |
|---|---|
| Vulnerable | A system contains a security hole. |
| Offline as a precaution | The administrator temporarily limits accessibility. |
| Confirmed compromised | Investigation shows unauthorized access or misuse. |
A fault message alone does not prove data theft.
Which PHP updates solve the problem?
The PHP Project published these security releases on October 21, 2026: PHP Project
| PHP series | Release with the security fixes |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Operating system suppliers can also incorporate the solutions into their own packages. Therefore, let the supplier or administrator confirm which package is safe. PHP 8.1 and older versions no longer receive regular updates from the PHP project; support from other vendors may vary. PHP project
What does this mean for WordPress websites?
WordPress uses PHP. Simply updating WordPress, a theme or a plugin does not replace the PHP installation on the server. Wordfence therefore emphasizes that owners should determine who is responsible for the PHP update: the hosting provider or their own technical team. Wordfence
Ask that party for concrete confirmation of the installed security solution. In the event of an interruption, also ask when the service can be resumed in a controlled manner.
Frequently asked questions about the PHP leaks
Is the entire internet down?
The sources consulted do not substantiate that claim. There is a broad technical risk, while the consequences differ per service.
Has an offline website been hacked?
That does not follow from the inaccessibility. An administrator can deliberately temporarily disable a website.
Is a WordPress update enough?
The PHP installation must be updated separately by the party managing the server. Wordfence
Are temporary protective measures enough?
According to the PHP Project, only updating provides a complete fix for these vulnerabilities. Temporary measures can reduce exposure to specific attack routes. PHP project
Sources
PHP Project - Official Security Notice and Releases as of October 21, 2026
CERT-EU — Critical Vulnerabilities in PHP, Opinion 2026-018
Australian Cyber Security Center – critical PHP warning on website, October 21, 2026
Wordfence — PSA: Upcoming Critical PHP Security Release
Further reading
Cyber incidents at supermarkets: digital risks in the physical world