CSA and NITA order government institutions to fix critical PHP vulnerabilities within seven days

Two critical vulnerabilities in PHP, a programming language that underpins much of the internet, have prompted governments and companies worldwide to temporarily take websites offline. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow an attacker to execute remote code on servers without needing authentication.

The US Cybersecurity and Infrastructure Security Agency (CISA) has labeled these weaknesses "php2shell." PHP’s development team released patches on Wednesday, urging users to apply them immediately. These vulnerabilities carry a severity rating of 9.2 out of 10 and impact all PHP installations serving web requests, including platforms such as WordPress, Drupal, and Joomla.

The European Union’s computer emergency response team advised organizations unable to patch promptly to isolate exposed applications from the internet. Proof of concepts for the vulnerabilities are already circulating, raising the possibility that they are already being exploited. Security firms have reported attack attempts, though confirmed successes are yet to be documented.

The US National Security Agency (NSA) advised organizations to prepare to update, with CISA and the UK’s National Cyber Security Centre urging patches to be applied as soon as possible. Several countries, including the Netherlands, Finland, France, Denmark, Australia, and Japan, took their websites offline as a precautionary measure.

This includes the Netherlands' DigiD digital identity system and parliamentary websites, Finland's public services, France's prefecture websites, and Japan's government portals. Japanese Prime Minister Sanae Takaichi urged the public to check their websites using PHP and prepare to apply the fix.