PHP vulnerability leads to website shutdowns for emergency patching

Millions of websites worldwide went dark after governments and system administrators took servers offline to patch a critical vulnerability in PHP, the programming language that powers roughly 70 percent of websites. National security agencies in Washington and London issued urgent warnings after the flaw became public on Tuesday, forcing organisations from European municipal governments to global digital platforms to scramble for emergency software updates.

Global Outages Prompt Emergency Server Shutdowns

Government infrastructure across Europe and Australia felt the immediate impact of the security alert. In the Netherlands, authorities temporarily deactivated the national digital identity service, the website of the house of representatives, and the site of the national cybersecurity centre. French local government portals, including the website of the Paris police prefecture, also went offline alongside council websites in Oxford, Bristol, and Edinburgh in the UK.

The Australian Signals Directorate confirmed that its systems were temporarily affected overnight by the outage.

AI Discovery and the Leak That Accelerated Disclosure

The PHP Foundation had originally planned to disclose the vulnerability later in the month alongside a scheduled software patch. However, details of the flaw leaked on social media on Tuesday, forcing an immediate public release of the fix. Cybersecurity firms Calif and Wiz identified the core weaknesses over the preceding two months using advanced artificial intelligence tools as part of an initiative started by OpenAI called Patch the Planet. OpenAI stated in a blog post that an internal researcher discovered the issue around the same time.

The National Cyber Security Centre in the UK explained that the issue involves two distinct technical failures under CVE-2026-109618 and CVE-2026-109619. Request cleanup may then treat the invalid data as valid. An attacker can trigger an out-of-memory condition in PHP that results in memory corruption, allowing request cleanup or stale internal states to be treated as valid data. Under specific conditions, this grants unauthenticated remote code execution on any web server running the software.

Ongoing Vulnerability and the Risk of Long-Tail Attacks

The US National Security Agency advised all organisations using PHP to take their systems offline immediately if they could not apply the security update. It said the vulnerability could provide a direct path to the server’s file system or database. The UK National Cyber Security Centre similarly instructed system administrators to check for backdoors installed by an attacker before bringing services back online.

Prof Alan Woodward from Surrey University warned that a long tail of unmaintained websites will remain exposed for weeks and months. He said: It was very surprising and troubling because of the extent to which PHP was used around the world. Internet infrastructure experts noted that automated exploitation could allow malicious actors and state-backed groups to deploy cryptocurrency miners or launch distributed denial of service attacks against vulnerable targets.

OpenAI Invests in Open-Source Project Support

Open-source projects can apply to Patch the Planet for hands-on support. OpenAI stated: We’re investing in models, tools, and partnerships to help defenders put those capabilities to work.