{
  "id": 15992787,
  "title": "Global alert over two critical PHP flaws forces government websites offline",
  "url": "https://urgent.news/2026/10/22/global-alert-over-two-critical-php-flaws-forces-government-websites",
  "topic": "business",
  "section": "Business",
  "published": "2026-10-22T02:14:00.000Z",
  "source": {
    "name": "MercoPress",
    "slug": "mercopress",
    "url": "https://en.mercopress.com/2026/10/22/global-alert-over-two-critical-php-flaws-forces-government-websites-offline"
  },
  "original_language": "en",
  "account": "Two critical vulnerabilities in PHP, a programming language that underpins much of the internet, have prompted governments and companies worldwide to temporarily take websites offline. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow an attacker to execute remote code on servers without needing authentication. The US Cybersecurity and Infrastructure Security Agency (CISA) has labeled these weaknesses \"php2shell.\" PHP’s development team released patches on Wednesday, urging users to apply them immediately. These vulnerabilities carry a severity rating of 9.2 out of 10 and impact all PHP installations serving web requests, including platforms such as WordPress, Drupal, and Joomla. The European Union’s computer emergency response team advised organizations unable to patch promptly to isolate exposed applications from the internet. Proof of concepts for the vulnerabilities are already circulating, raising the possibility that they are already being exploited. Security firms have reported attack attempts, though confirmed successes are yet to be documented. The US National Security Agency (NSA) advised organizations to prepare to update, with CISA and the UK’s National Cyber Security Centre urging patches to be applied as soon as possible. Several countries, including the Netherlands, Finland, France, Denmark, Australia, and Japan, took their websites offline as a precautionary measure. This includes the Netherlands' DigiD digital identity system and parliamentary websites, Finland's public services, France's prefecture websites, and Japan's government portals. Japanese Prime Minister Sanae Takaichi urged the public to check their websites using PHP and prepare to apply the fix.",
  "summary": "Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}