PHP security crisis live — all the latest news as issues affect websites across the world

Supply chains could be another area hit by the PHP issue, as one affected company taking their systems offline could cause a butterfly effect across an industry.

“A single vulnerability can trigger a global domino effect across borders and industries within hours. What we’re seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI," notes Chris Dimitriadis, Chief Global Strategy Officer at ISACA.

 “But the real concern isn’t just the vulnerability itself. It’s what it reveals about our preparedness. Cyber resilience isn’t something organisations can switch on when a crisis hits. They need to understand where they are exposed, recognise their technology dependencies and have the right people, processes and controls in place to respond quickly and effectively.

 “Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a security flaw from becoming a much bigger crisis. Most of all, that means investing in the next generation of cybersecurity professionals, who can use AI to find and fix weaknesses faster than attackers can exploit them.”

What role did AI - and OpenAI - play?

An interesting note about the PHP flaws is that they were detected (at least partly) by AI.

Ryan Austin, the researcher at cybersecurity firm Calif who played a major role in uncovering the PHP flaw, has acknowledged the part OpenAI's systems played in revealing the issues.

Potential PHP flaws had first been spotted back in 2024 by its own researchers, but it had to wait until July 2026 before being accepted into OpenAI’s Patch the Planet initiative, which looks to use advanced AI systems to detect and solve cybersecurity issues.

Calif, which was part of Patch the Planet, then found a more serious issue in PHP in August 2026, which was spotted by OpenAI's own systems shortly after, before the group began working on a fix.

"Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications," OpenAI's blog post noted.

"Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."

Who has been affected so far?

With an issue as widespread as this (some reports are claiming around 70% of the web as we know it could be affected) it's tricky to list all the affected sites and businesses - mainly because many won't want to admit to any security shortcomings.

Thanks to Reuters, we do know that several European governments have seen some effect, although many of the sites are now back up online, including:

- The German digital ​ministry said federal IT service provider ITZBund had taken several websites offline due to ​the discovery of PHP vulnerabilities, although this was a "purely preventive" move.

- The French Interior Ministry temporarily took down the ​websites of local government administrative offices while awaiting the PHP patches - again, this was a preventive measure.

- Belgium's foreign ministry temporarily took its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although this was not confirmed.

- In the Netherlands, the nation's National Cyber Security Centre ​took its public-facing sites offline, along with those belonging to the Port of Rotterdam, the Dutch national football association KNVB, the ‌websites of ⁠the five largest political parties and numerous hospital websites across the country.

"A finite window" to patch and protect

This is clearly an alarming issue, one which will likely affect companies of all sizes across the globe, so how quickly should businesses look to respond?

"This is a stake-in-the-ground moment for CISOs around the world," says Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.

"Organisations of every size have a finite window to shore up their cyber defences, because threats now operate at machine speed. Patch fast, know your attack surface and limit the blast radius, because that window is closing. If we don't act now, we will see more organisations forced to take their sites offline while they scramble to fix what should have been secured long ago."

Open source worries

The issue may raise wider concerns about the role of open source software in propping up some of the most integral parts of the global information network - as the very thing that makes it so unique also leaves it vulnerable to flaws and security concerns.

"Much of the critical software running the world is also the least visible. Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," says Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.

"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."

"The ripple effects from vulnerabilities in foundational software like PHP can extend across entire industries. This makes it critical to have a trusted software source that helps manage this risk and, ideally, quickly responds to these new threats as they emerge."

PHP fixes are out now - so get patching

As we've covered on TechRadar Pro this morning, PHP has now released its emergency fixes for users to download.

The issues are listed as CVE-2026-109618 and CVE-2026-109619 - the former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.

Wondering how this affects you?

While most websites are back up and running, there were some that were taken offline yesterday after the news broke. Did you notice anything amiss? Tell us in the comments above, or vote in the poll to let us know what you normally do when you hear about cybersecurity issues in the news.

What has actually happened?

It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.

Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources.

So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.

Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now.

What is PHP?

PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.

PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.

News of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems.

The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.

PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."