European governments pull websites and NSA warns over PHP flaws
Germany and France took official sites offline and the NSA urged updates. Exploitation attempts are under way, and a patch exists for four PHP branches.
Germany and France took official websites offline, and the U.S. National Security Agency (NSA) urged organizations to update PHP immediately or disconnect whatever cannot be patched. Germany's Ministry for Digital Transformation pulled pages as a precaution, and France's Interior Ministry disabled the sites of local administrative offices. Belgium, the Netherlands, Finland and the Czech Republic also shut sites while they applied the patch.
The reaction came a day after the PHP project published its advisory on two flaws, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution without a password and score 9.2 out of 10 on CVSS v4.0, the scale that measures the severity of a vulnerability. The Netherlands was the first country to take sites down.
What the NSA said
Its message was unusual: it asked every organization that uses PHP in its systems to prepare for an immediate update. The agency did not say which American sites went offline.
Exploitation attempts are already under way
The first known attempt dates from Oct. 17, recorded by Amazon before the flaws were disclosed. The security firm watchTowr says it has observed attacks on the internet since Oct. 21. So far there is no confirmed case of a successful intrusion.
What needs updating
PHP fixed the flaw on Oct. 21 in these versions:
| Branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Branches 7.4, 8.0 and 8.1 no longer receive official support, but they have minimal patches and some Linux distributions include them. The advisory is blunt: no configuration change fully mitigates the flaws, and updating is the only safe option. The risk is higher with Apache and mod_php, though any installation that serves web requests is exposed.
Anyone running a store, blog or portal on PHP should check which version is running and restart processes after updating. On shared hosting, confirmation of the patch has to come from the provider. For ordinary readers, the effect is on service: pages may be down or under maintenance while administrators work.
Network devices are the gap. Palo Alto Networks acknowledges the problem across PAN-OS and Panorama, with no fixed versions for now. QNAP has no patch for its NAS devices either, and until it does the measure is to remove them from direct internet access.
