Developers of the PHP programming language have rushed out a new version with two critical fixes and strongly encouraged users to update immediately to protect websites worldwide.
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of flaws in one of the world’s most widely used programming languages.
Amid reports that hackers were already exploiting the vulnerabilities to break into websites, government agencies in the Netherlands and Finland were among those that took sites offline as a precaution.
PHP underpins large parts of the internet, raising concerns that a significant number of websites could be vulnerable to attack. (Story continues below)
An urgent update notice posted at Php.net on Oct 21, 2026.
“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” the cybersecurity company Huntress said in a blog post.
Dane Knecht, the chief technology officer of the Web and cloud security firm Cloudflare, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.
“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said in a post on X.
Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.
Cybersecurity agencies in Europe, Australia, Japan and Britain have urged PHP users to update immediately or take websites offline until patches can be applied. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.
Officials have said that all PHP versions from PHP 5 onward could be affected, although PHP has not yet disclosed which versions are vulnerable.
PHP powers an estimated 70% of all websites — a figure in the hundreds of millions — that have a known server-side programming language.
A major reason for this dominance is WordPress, which is entirely built on PHP and powers 43% of the entire web.