Governments take websites offline as PHP attacks begin

PHP released security updates on 21 October for two critical flaws that let an attacker run code on a web server without logging in. Versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 on the CVSS v4.0 scale.^[1] If your business, your clients or your publication runs WordPress, WooCommerce, Magento or Drupal, all of which run on PHP, this is the update to check today.^[3]

Governments take websites offline

Government agencies in the Netherlands and Finland took websites offline as a precaution on 21 October, and the Dutch cybersecurity agency took its own site down too, Reuters reported. Cybersecurity agencies in Europe, Australia, Japan and Britain urged PHP users to update immediately or take sites offline until patches were applied.^[5]

In Belgium and the Netherlands, the outages reached well beyond government. The Brussels Times listed the Dutch government portal MijnOverheid, the school platform Smartschool, several Roularta and DPG Media sites, Antwerp's AZ Monica hospital and the pharmacists' body KNMP among those that went offline, with notices describing the outages as maintenance. Ethical hacker Inti De Ceukelaire told Belga he had taken his own websites offline, something he said he had never done before.^[6]

Businesses have done the same. HR software company BambooHR took its service offline in the US, Canada and Ireland as a precaution, and in the Netherlands the DigiD login service and the lower house of parliament's website also went offline, The Hacker News reported.^[13]

Australia has not escaped. Australian government websites, including the Australian Signals Directorate's cyber.gov.au, were among those affected by the PHP issue, the ABC reported early on Thursday; it did not say what the impact was.^[16]

SmartCompany reported on Thursday that the Australian Bureau of Statistics, the Treasury and Parliament House also went offline before returning to normal. Small businesses followed: Townsville training provider HANMAC and Mount Martha IT support firm ByteOn Computer Services took their sites down as a precaution, while Adelaide conveyancer Eckermanns said its site was back online after applying the patches. Lawpath managing lawyer Anya Pinch urged small businesses to ask their web host or developer whether the threat had been addressed: "Small businesses don't have a security team on call, so the time to plan is before something goes wrong, not after."^[19]

Security agencies: update now, or take it offline

The language from the agencies is blunt. The US National Security Agency's cybersecurity directorate told every organisation using PHP, "effective immediately", to be ready for the update, warning the flaws "often provide a direct path to the server's file system or database". If an immediate update is not feasible, it said, "organizations take the system offline until it can be fully mitigated."^[7]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.

— NSA Cyber (@NSACyber) October 21, 2026

Britain's National Cyber Security Centre said organisations using any version of PHP are affected. It told them to find every PHP system, starting with internet-facing ones, update to the latest release, and, where they can't patch or mitigate quickly, consider taking the system offline. Systems that can't be updated or switched off straight away should be checked for signs of compromise and backdoors.^[8]

The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

— NCSC UK (@NCSC) October 21, 2026

OpenAI says its models helped researchers in its Patch the Planet initiative find the flaws, and that it spent two months leading a coalition of maintainers, researchers and security providers to prepare fixes before disclosure because the fix "required a major change to the PHP engine". It called the bug "one of the most impactful vulnerabilities in recent memory".^[9]

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

— OpenAI (@OpenAI) October 21, 2026

Security researcher Kevin Beaumont said the PHP situation "will lead to a mass of incidents" and called it one of the biggest vulnerabilities in years; forensics expert Hal Pomeranz warned "there will be a long tail for this one." Investors moved too: Cloudflare shares were up about 5.5 per cent in Wednesday trading in New York, with CrowdStrike and Palo Alto Networks also higher, Investing.com reported.^[14]

What the flaws do

CVE-2026-109618 is a remote code execution flaw triggered through out-of-memory corruption, and CVE-2026-109619 is one triggered through stale global state left behind between requests. The PHP project says the risk is highest for servers using mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs. That means a WordPress login page or a checkout plugin offers no protection.^[1]

The PHP security team was blunt: "There are no complete mitigations, updating is the only safe choice." Configuration changes reduce exposure to specific attack paths but do not make a server safe. PHP 8.1 and older no longer get official updates; the team has published minimal backports for PHP 7.4, 8.0 and 8.1 for people who build PHP from source, and Linux distributions received the patches in advance.^[1]

How the embargo broke

The flaws were due to be disclosed on 22 October under embargo, but the CVE numbers circulated on Hacker News and social media on 20 October, and PHP brought the release forward to 21 October, Tenable reported. Code claiming to exploit the flaws is circulating online; Tenable has not verified it and warns that unverified exploit code may itself contain malware.^[2] Cloudflare's chief technology officer said the company was already seeing early attacks and was updating its firewall rules, which it described as a stopgap.^[2]

WordPress security firm Patchstack has since updated its alert to say "multiple active exploitation incidents" have been confirmed, and that the only fix is to upgrade PHP.^[11] Security firm watchTowr said its sensors picked up the first exploitation attempts as the patches landed but had seen none succeed. "Whilst nobody has been successful to date, we don't expect that will last long," its head of threat intelligence, Jake Knott, said.[15] For online stores, ecommerce security firm Sansec advises that if PHP can't be patched within the hour, owners should consider putting the store into read-only mode or taking it offline until it is.^[12]

In Australia, the Australian Signals Directorate issued an alert before the patches existed, flagged on its X account with the status “Critical”. "We are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards," it said, urging administrators to monitor PHP applications and be ready to update.^[3] CERT-EU told organisations to "patch as soon as fixed versions become available" and, where that isn't feasible, to consider isolating internet-facing applications from public networks.^[4]

What Australian marketers and agencies should do

Two details matter for whoever does the update. Linux distributions received the patches in advance, so a server's PHP package may carry an older-looking version number and still be fixed; check its changelog for the two CVE numbers, not the version string. And PHP 8.2, one of the four patched branches, reaches end of life on 31 December 2026, so sites on it face another upgrade within weeks.^[13]

If a site has to go offline while PHP is patched, protect its search rankings. Google Search Central said serving a 503 (Service Unavailable) status "ensures already indexed URLs are preserved in Search while you work", and Google's John Mueller advised using a 503 rather than letting pages time out or return 404 or 500 errors, set at the CDN or server level because a PHP-built 503 won't work with PHP down. Google's documentation warns that a URL returning 503 for more than one to two days may be dropped from Search, and robots.txt should stay reachable throughout.^[18]

For WordPress sites, the PHP version is shown in the dashboard under Tools, Site Health, Info, Server, GoDaddy notes in its guidance for site owners, which also advises taking a backup or snapshot before updating.^[17]

PHP runs 69.3 per cent of websites whose server-side language is known, according to W3Techs figures cited by Tenable.^[2] For most Australian brands that sits with a host or an agency, not an in-house engineer. The practical step is to ask whoever runs your site, today, which PHP version it is on and when it moves to one of the four patched releases. Sites still on PHP 8.1 or older have no official fix at all, which makes an upgrade, not a patch, the job. For agencies managing dozens of client WordPress and WooCommerce sites, this is a client-by-client check, and the clients will want to hear it from you first.