In a world where much of the web rests on quiet, free foundations, a pair of serious flaws in the PHP programming language has reminded everyone how fragile that shared ground can be. Patches now exist, but they arrived after a confidential repair effort was undone by a leak, and attacks had already begun. Governments and institutions, cautious by nature, chose to step back from their own digital doorways while the community races to close the gap.
PHP Patches Released as Hackers Begin Exploiting Critical Flaws Affecting Millions of Websites
Hackers were already trying before the fix even existed
Mark
Why did the leak matter so much? The patch was only a day away.
Mimi
Because the flaws were secret from August until Tuesday. The developers had a plan to disclose and fix together. Once the news got out, attackers had a day's head start on a fix that wasn't yet public.
Luke
And Cloudflare's CTO said attacks were emerging. That's one company's observation, quoted in an online post. We don't have a count of compromised sites.
Mark
What do the flaws allow?
Mimi
Remote takeover of websites and servers, bypassing things like password-protected accounts. That's what the developers described.
Luke
Worth saying that's the potential. The reporting doesn't confirm any specific government database or customer record was actually reached.
Mark
Why did governments take sites offline instead of waiting?
Mimi
The NSA's advice was plain: if you can't update immediately, go offline. France, Germany, Belgium and the Netherlands all did some version of that.
Luke
The Belgian and Dutch cases are described as precautions, which suggests no breach. I wouldn't read more into it than that.
Mark
Anything unusual about how the flaws were found?
Mimi
Two firms, Calif and Wiz, each flagged them in August using AI tools.
Luke
Which tells us how they were found, not whether attackers used similar tools. That's unknown from this reporting.
The Pulse
- Two critical PHP flaws could let attackers seize control of websites and servers without passing ordinary password barriers.
- Details leaked a day before the planned update, and attackers were already probing systems when patches finally appeared.
- France, Germany, Belgium and the Netherlands pulled government sites offline, while the NSA urged unpatched operators to take systems down entirely.
- Operators are racing to apply updates, and the coming days will reveal whether unpatched systems were breached and what federal reviews uncover.
In a world where much of the web rests on quiet, free foundations, a pair of serious flaws in the PHP programming language has reminded everyone how fragile that shared ground can be. Patches now exist, but they arrived after a confidential repair effort was undone by a leak, and attacks had already begun. Governments and institutions, cautious by nature, chose to step back from their own digital doorways while the community races to close the gap.
On Wednesday, the developers of PHP announced that patches were available for two serious security flaws in the open-source language. By then, governments on several continents had already taken websites offline. The PHP team urged every user to update immediately, and the PHP Foundation was even blunter: if you run PHP, updating now is imperative.
PHP is free software that millions of websites rely on, including government portals, infrastructure, news outlets and online shops. The flaws, rated critical, could let attackers take remote control of sites and servers and bypass protections such as password-protected accounts. From there, intruders could reach government databases and customer data, deface pages, or compromise entire businesses.
The bugs had been flagged in August by two security firms, Calif and Wiz, both using AI tools to find them. Developers kept the details confidential while they built a fix, but the plan collapsed on Tuesday when news leaked a day before the scheduled release. Cloudflare's chief technology officer said attacks had already started and that mitigations were being updated as new routes appeared.
Wikimedia said it was working on the problem and had temporarily taken some systems down. Across Europe and beyond, authorities acted to get ahead of possible attacks. France took the Paris Police Prefecture site and local government pages offline, Germany removed some PHP-based sites, Belgium's Foreign Ministry blocked its own presence, and the Dutch cybersecurity agency went dark as well. The US National Security Agency warned that such flaws often open a direct path to a server's files and databases, and advised offline operation for any system that cannot be updated immediately. The White House said it learned of the issue last week and that federal agencies are assessing the impact.
With the fixes published, the central question is how fast operators can apply them, since attacks came before the patch existed. What unpatched systems suffer, and what federal reviews reveal, will show how much the early leak cost.
On Wednesday afternoon, the developers of PHP announced that patches were online for two serious security flaws in the open-source programming language. By then, governments on several continents had already pulled websites offline. "All PHP users are strongly encouraged to update immediately," the team said in a statement. The PHP Foundation was blunter in a blog post: if you run PHP, updating now is imperative.
PHP is free software, and millions of websites depend on it. They include government portals, critical infrastructure, news sites and online shops. The two flaws are catalogued as CVE-2026-109618 and CVE-2026-109619, and both are rated critical. According to the developers, hackers could use them to take remote control of websites and servers, getting around ordinary barriers such as password-protected accounts. Once inside, attackers could reach government databases and customer data, deface sites, or compromise whole businesses and other online services.
The vulnerabilities were flagged in August by two separate security companies, Calif and Wiz. Both used AI tools to find the problems. The PHP developers kept the details confidential while they built a fix. That plan broke down on Tuesday, when news of the flaws leaked a day before the scheduled update.
Hours before the patches arrived, Dane Knecht, chief technology officer of the security firm Cloudflare, said attacks had already begun. "We are seeing early attacks emerging and are updating mitigations as new vectors show up," he wrote in an online post.
The Wikimedia Foundation, which runs Wikipedia, said it was addressing the vulnerabilities. It said it had taken down a number of other systems as a precaution until they could be safely patched.
Authorities in multiple countries, among them Australia, Japan and several European nations, issued warnings and took government websites down to get ahead of possible attacks. In France, the site of the Paris Police Prefecture went offline after the "detection of a critical security vulnerability," along with local government pages. Germany's government IT service removed some sites that use PHP. Belgium's Foreign Ministry temporarily blocked its own online presence, and the Dutch cybersecurity agency also took itself offline as a precaution.
The US National Security Agency warned that flaws of this kind often give a direct path to a server's file system or database. In a post on X, it advised that organizations unable to update right away should take the affected system offline until it can be fully mitigated. The White House said it was told of the issue last week, and that US federal agencies are assessing the potential impact on government systems and infrastructure.
With the patches now published, the question is how quickly operators apply them, since attacks were already being seen before the fix existed. Whether unpatched systems are compromised, and what federal agencies find in their assessment, will show how much the early leak cost.
Notable Quotes
We are seeing early attacks emerging and are updating mitigations as new vectors show up.— Dane Knecht, CTO of Cloudflare
If an immediate update is not feasible, organizations should take the system offline until it can be fully mitigated.— US National Security Agency, on X (paraphrased)
Want the full story?
Read the original at Deutsche Welle ↗
Politics & Governance