{
  "id": 15995836,
  "title": "PHP Security Vulnerabilities Explained: Why Are Websites Being Taken Down Worldwide?",
  "url": "https://urgent.news/2026/10/22/php-security-vulnerabilities-explained-why-are-websites-being-taken",
  "topic": "world",
  "section": "World",
  "published": "2026-10-22T03:44:41.000Z",
  "source": {
    "name": "Free Press Journal",
    "slug": "free-press-journal",
    "url": "https://www.freepressjournal.in/tech/php-security-vulnerabilities-explained-why-are-websites-being-taken-down-worldwide"
  },
  "original_language": "en",
  "account": "Two critical vulnerabilities were discovered in PHP, a widely used programming language often employed by websites, platforms, and software services. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute unauthorized code without needing authentication, posing a significant security risk. The issues, rated 9.2 on the severity scale, could potentially expose server memory and enable unauthenticated remote code execution.\n\nThe vulnerabilities, which have remained undetected for over a decade, were identified through advanced AI tools by researchers at Calif and Wiz, who dubbed them the most severe vulnerabilities AI had ever uncovered. The PHP Foundation, in collaboration with OpenAI's Patch the Planet program, released emergency patches on Wednesday, October 21, 2026, following the disclosure. These patches address memory handling issues and leftover internal state in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.\n\nThe vulnerabilities affect roughly 70 percent of the internet, encompassing platforms like WordPress, Drupal, Joomla, and Magento, as well as shared hosting services and third-party products that integrate PHP. High-profile institutions, including government portals, public broadcasters, community platforms, and even cloud service providers like Cloudflare, have been affected and have taken their sites offline as a precautionary measure. Some organizations have advised their users to switch their systems off until the vulnerabilities are patched.\n\nAs agencies worldwide warn of potential system compromise, cybersecurity experts stress the importance of updating to the latest PHP versions to mitigate the risks associated with these vulnerabilities.",
  "summary": "Government portals, public broadcasters and community platforms went offline after two critical flaws were disclosed in PHP, one of the most widely used programming languages on the web. Agencies in several countries have told organisations that cannot patch immediately to consider switching their sites off until they can. What is PHP and why does it matter? PHP is a scripting language that runs…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}