PHP security crisis live — all the latest news as issues affect websites across the world
PHP issues are affecting websites across the globe - we're covering the latest news and updates as it happens.
Websites worldwide are grappling to safeguard themselves against potential cyberattacks following a critical security flaw discovered in the widely-used PHP programming language. Organizations are urged to update their systems immediately, as hackers are prepared to exploit the vulnerability. PHP has issued patches, but some users are reporting difficulties with certain websites.
The issue was first reported yesterday when PHP disclosed two critical vulnerabilities that could enable remote code execution (RCE) attacks, leading to website takeovers, data theft, and malicious redirects. While no companies or websites have been hacked yet, several government websites in Scotland and the Netherlands, along with a Danish IT firm, briefly experienced outages as a result of the issue.
PHP, a popular programming language for websites and web applications, has been around for decades but its importance means flaws can often go unnoticed for years. Despite the widespread attention, users are now urged to download the emergency fixes released by PHP, which address vulnerabilities CVE-2026-109618 and CVE-2026-109619.
These issues, classified as critical with a severity score of 9.2/10, affect PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The incident highlights the risks associated with open source software, as vulnerabilities in foundational systems like PHP can have far-reaching effects across industries.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
