Government agencies in the Netherlands and Finland were among those that temporarily shut down websites as a precaution while developers rushed to release emergency security updates.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each been assigned a critical severity score of 9.2 out of 10.
PHP developers released fixes on Wednesday, but cybersecurity authorities warned that websites remaining on vulnerable versions could still face attacks.
FBI warns of remote hacking risk
The FBI's Cyber Division issued an urgent advisory, warning that the vulnerabilities could expose sensitive information and compromise networks.
"Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks," the FBI said on X.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
— FBI Cyber Division (@FBICyberDiv) October 21, 2026
Remote code execution means attackers could potentially run malicious commands on a vulnerable website's server without needing to log in.
The FBI urged organisations to identify where PHP is running, prioritise internet-facing systems and install the latest security updates.
It also advised taking affected systems offline if immediate patching was not possible. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," the agency said.
The FBI further urged website operators to monitor servers for unusual activity, including PHP processes unexpectedly launching command shells or downloading files. Organisations that discover signs of a breach should isolate affected systems, preserve server logs and report the incident to the authorities, it said.
Government websites taken offline in Europe
According to Reuters, government agencies in the Netherlands and Finland were among those that temporarily took websites offline ahead of the emergency security fixes.
The precautionary shutdowns followed warnings that attackers could exploit the vulnerabilities before organisations had time to update their systems.
The outages were preventive measures and did not necessarily mean the affected government websites had been successfully hacked.
PHP is one of the most widely used programming languages for running websites. It works behind the scenes, processing requests, managing databases, and generating content displayed to users.
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said in a blog post, according to Reuters.
The widespread use of PHP means vulnerabilities in its core software can potentially affect websites across industries, including government services, online shopping and publishing.
However, not every website using PHP is necessarily exposed in the same way. The risk depends on the software version, server configuration, and security protections in place.