Security patches for two critical PHP vulnerabilities were released on October 21, 2026, as government websites in the Netherlands and Finland went offline as a precaution and hackers were reportedly exploiting the flaws. The fixes require action beyond WordPress’s automatic updates, security provider Wordfence warned.
Key takeaways
- PHP developers rated the vulnerabilities 9.2 out of 10.
- Authorities urged immediate patching or temporary website isolation.
- Cloudflare’s firewall changes are a stopgap, not a patch replacement.
Critical PHP vulnerabilities threaten widely used websites
PHP developers disclosed two critical vulnerabilities on October 20, assigning them a severity score of 9.2 out of 10. Security patches were released on October 21 at 10 a.m. ET.
Cybersecurity firm watchTowr described the flaws as remote code execution vulnerabilities: attackers can run their own code on affected servers, potentially altering websites or stealing data. Officials said versions from PHP 5 onward could be affected.
The programming language supports WordPress, Drupal, Joomla and Magento, along with shared hosting platforms and control panels, cybersecurity company Huntress said in a blog post. WordPress reported in 2025 that it powered more than 40 percent of the internet. A security researcher estimated that more than 1.3 million internet-connected hosts were likely affected.
Government sites go offline as attacks emerge
Government agencies in the Netherlands and Finland took websites offline on October 21 as a precaution. The Dutch cybersecurity agency also shut down its own website because of the vulnerabilities.
Cybersecurity agencies across Europe and in Australia, Japan and Britain urged PHP users to update immediately or suspend websites until patches can be applied. The European Union Computer Emergency Response Team and the UK National Cyber Security Centre advised organizations unable to patch immediately to isolate internet-facing applications from public networks or take them offline.
GrapheneOS temporarily closed its user discussion forum, citing proof-of-concept exploit development. PHP developer Gina Peter Banyard said patching was the only mitigation and described shutting servers down as potentially the most sensible alternative.
Hackers were reportedly already exploiting the flaws. Cloudflare chief technology officer Dane Knecht reported early attacks, while Sansec threat researchers said they expected “mass attacks within 15 minutes of the release.”
WordPress updates do not apply the PHP fix
Automatic WordPress updates do not install the PHP patch, Wordfence warned. The security plugin provider said every WordPress site runs on a server using PHP and urged owners to identify who manages that server’s PHP updates so the fix can be applied manually.
For website owners responding to PHP’s critical vulnerabilities, the agencies’ advice was to patch immediately or keep affected systems offline until they can be secured.
Cloudflare is updating its firewall rules against emerging exploit attempts, but Knecht stressed the temporary nature of that protection. “We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he wrote on X.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.