Developers of PHP, a backbone language for the internet, have warned that a security update might take millions of websites offline temporarily, sparking panic in the tech world.
The PHP Foundation, which describes itself as a "structured governance model designed to ensure transparency, accountability, and effective stewardship" of the language, announced a security update in a social media post to address "two critical vulnerabilities" that could be exploited by hackers. "PHP users are encouraged to prepare to update," the post said.
According to the PHP Foundation, "PHP stands for PHP: Hypertext Preprocessor, which confuses many people because the first word of the acronym is the acronym". PHP is an HTML-embedded scripting language designed during the earliest days of the internet that sought to simplify how web developers write and maintain websites quickly.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
— The PHP Foundation (@ThePHPF) October 20, 2026
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Government websites around the world have gone dark to prepare for the PHP patch and to lessen the likelihood that the vulnerabilities are exploited. Japan's Prime Minister Sanae Takaichi was one of several world leaders to address the issue.
"We have an urgent request for everyone to take action tonight," she posted on X. "Regarding PHP, which is used on many websites, the PHP security team has issued a warning about two critical vulnerabilities. Please check if your publicly available websites use PHP, and prepare to apply the fix."
The Netherlands, Finland, France and Australia have taken several government services offline temporarily to implement the patch and prevent any problems.
In the US, the National Security Agency's cybersecurity division also composed a strongly worded warning.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update," the NSA's post on X read.
"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance."