Critical PHP Flaws Force Sites Offline: What Business Owners Should Do Now

If your website went down this week, you may be wondering why. Or maybe you’re worried yours is next.

Two serious security flaws were found in PHP. It’s a programming language that runs a huge slice of the web. The fix came out on Wednesday, October 21, 2026. Many sites have not applied it yet.

We’ve kept businesses safe for over 20 years. Here is what happened, in plain words, and what to do about it.

Why Governments Pulled Sites Offline

This is not a small story. Agencies around the world reacted fast.

According to the BBC, Finland temporarily shut down its government’s public web services. The Netherlands’ cyber agency took its own site down. The Dutch health institute RIVM and the lower house of parliament went dark too.

The US National Security Agency told organizations to take systems offline if they can’t update. It warned that these flaws can give attackers a direct path to the server’s files or database.

The UK’s NCSC gave the same advice. EU and Japanese cyber officials issued similar warnings. Japan’s prime minister urged people to check whether their public sites run on PHP. The White House said federal agencies were working with leading AI labs to speed up a fix.

Wikimedia took some systems offline as a precaution. Edinburgh council’s site went down. So did pages for several BBC shows. DeviantArt posted a maintenance notice. None of them confirmed PHP as the cause, so treat those as unconfirmed.

What Actually Went Wrong

Both flaws are memory bugs in how PHP handles requests. CERT-EU lists them as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10, which is critical.

In short, an attacker can send a crafted request. No login is needed. If it works, they can run their own code on your server. That can mean malware, stolen data, or a site taken down.

Who Found Them

Researchers at Calif and Wiz found the flaws. The BBC reports that they sat hidden for more than ten years. Teams using advanced AI tools tracked them down in a few weeks this summer.

Wiz said the AI helped build working exploits across several applications in hours. OpenAI called the find one of the most impactful security issues in recent memory.

PHP planned to share details later this month. But the details leaked on social media on Tuesday, October 20. That forced a rushed release. Per the PHP Foundation, the team moved the date up.

How Many Websites Use PHP?

You will see “70%” in headlines. Be careful with it. W3Techs reports PHP on 69.3% of sites whose server language is known. Wiz estimated that roughly 70% of the internet is affected. The BBC said it could not verify that figure.

Either way, the reach is huge. Security firm Huntress points out that PHP quietly powers WordPress, Drupal, Joomla, and Magento. It also hides inside hosting platforms, control panels, and software that never mentions it.

That last point matters. Many owners don’t know PHP runs under their tools.

The Attacks Are Real

This isn’t a “maybe someday” risk. Cloudflare’s CTO said the company saw early attacks and was updating its protections. Amazon Threat Intelligence saw an attempt on October 17. That’s four days before the public fix.

Which Versions Are Fixed?

The PHP team released these updates on October 21:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Older versions are the weak spot. PHP 8.1 and below get no official update. People running them are urged to upgrade. The PHP security team did publish small source backports for 7.4 through 8.1. CERT-EU says the flaws may reach back to PHP 5, which launched in 2004.

The official notice is on PHP.net.

What To Do Today

Work through these in order.

Find Every Place PHP Runs

This is the hard part. Sophos researcher Don Smith told the BBC that finding and managing every PHP instance is the real challenge. It can sit under public sites, content systems, hosting platforms, and third-party products.

Check your main site first. Then check test sites, old microsites, and customer portals. Ask your web host, too.

Update And Restart

Install the fixed version. Then restart PHP so the fix takes hold. If you use containers, rebuild them.

On Linux, vendors sometimes patch without changing the version number. Look for the two CVE IDs in the package notes.

Can’t Update Yet?

The PHP team lists settings that cut some risk. Aikido says to use both together:

• Set session.upload_progress.enabled to 0
• Set memory_limit to -1, so apps can’t change it

Then restart every worker. These steps are not a cure. They only buy time.

Look For Signs of a Break-In

A patch does not kick out someone who is already inside. Smith stressed that teams should watch for signs an attacker already got a foothold.

Check for:

• New admin accounts
• Files you don’t recognize
• Odd error bursts after file uploads
• Strange outbound connections

Consider changing passwords and API keys on exposed servers.

Should You Take Your Site Offline?

For most small businesses, the answer is: only if you can’t patch or protect it.

The NCSC says that where fixing right away isn’t possible, organizations should consider going offline until it’s fully handled. If your site holds customer data and you can’t update today, that advice fits you.

A brochure site with no stored data is a lower risk. Still, patch it soon. Attackers can use any server as a stepping stone.

How Doctor IT Services Can Help

You run a business. You shouldn’t need to hunt for PHP versions at night. Our team can find where PHP runs, patch it, and check for signs of attack. We can also set up 24/7 monitoring and cybersecurity so the next alert doesn’t surprise you.

We respond in under 60 seconds. We keep our pricing the most affordable around. Call us today if you want a second pair of eyes on your systems.