PHP vulnerability 2026 CVE-2026-109619 patch: Why are government, school, hospital websites going offline, new PHP updates are live

Developers of the PHP programming language said a set of new updates fixing two previously identified critical vulnerabilities was now live and strongly encouraged users to update immediately. PHP underpins large parts of the internet and the vulnerabilities had raised concerns that a significant number of websites could be vulnerable to attack.

US National Security Agency andgovernment websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in the widely used programming language left website operators scrambling to protect their systems. The updates were for a number of different versions of PHP.

The programming language's developers had earlier said they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released.


Several government, school and hospital websites in Europe were taken offline on Wednesday as organizations rushed to protect themselves from two critical security flaws in PHP, a programming language that powers a large share of the internet.

CERT-EU, the EU's cybersecurity response team, had warned that organizations unable to apply fixes in time should consider taking affected sites offline. PHP's developers said a set of new updates fixing two previously identified critical vulnerabilities was now live and strongly encouraged users to utilize them immediately.

The Dutch government was among those that took sites offline as a precaution. Cloudflare said it was seeing early attacks emerging, while Australia's cyber agency said it was not aware of active exploitation.

List of key websites and services reported offline

US National Security Agency

The agency urged organizations using PHP to be "prepared for an update addressing two critical vulnerabilities," warning that such flaws often provide "a direct path to the server's file system or database." In a post on X, the agency said organizations that cannot update immediately should take affected systems offline until the issue is fully mitigated, adding that it "will follow up shortly with more specific guidance."

Germany

A spokesperson for the German digital ministry told Reuters on Wednesday the federal IT service provider ITZBund had taken several websites offline due to the discovery of PHP vulnerabilities. The temporary deactivation was purely preventive and no security incidents were known to have occurred, he said.

France

The Interior Ministry said it had temporarily taken the websites of prefectures, which are local government administrative offices, offline while awaiting a security fix for the PHP framework they use. It said the move was a precaution pending a patch from the framework's publisher.

Belgium

Belgium's foreign ministry said it had temporarily taken its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although the country's cybersecurity centre said it had not recorded any attacks on Belgian websites.

Netherlands

Many organizations followed the example of the National Cyber Security Centre and preventively took their public-facing sites offline. They included the Port of Rotterdam, government site Overheid.nl, the national football association KNVB, the websites of the five largest political parties and numerous hospital websites across the country.

Finland

State IT centre Valtori shut down the government's public web services on Wednesday as "a precautionary measure." Valtori said it had not identified any attempt to exploit the flaws and that the outage was not the result of a data breach.

Wikimedia

The Wikimedia Foundation, which runs online encyclopedia Wikipedia, said it was in the process of addressing security vulnerabilities in the PHP programming language. All foundation-supported systems and volunteer-run systems that use PHP are affected, the foundation said in a statement.