Two critical security vulnerabilities in PHP have triggered precautionary action across the internet, including the temporary shutdown of public government web services in Finland and protective measures by the Wikimedia Foundation. Security advisories warn that the flaws could allow an attacker to execute code remotely on vulnerable systems without authentication.
What are the PHP vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Security advisories classify them as high-severity issues, with a reported CVSS v4 score of 9.2. Depending on how a vulnerable system is configured and exposed, successful exploitation could lead to unauthenticated remote code execution or access to sensitive memory.
PHP is used by many websites and web applications, and it can also be bundled inside third-party products. That means administrators may need to check not only directly managed PHP installations but also software and platforms that include PHP as a component.
Finland takes government web services offline
Finland’s government ICT Centre temporarily took public web services offline as a precaution while the risk was assessed. Yle reported outages affecting public-facing services, including the National Land Survey website. The precautionary shutdown should not be interpreted as proof that those services had been hacked; reporting at the time said there was no indication of active exploitation.
Wikimedia disables supporting services
The Wikimedia Foundation said it took some supporting services, including Toolforge and Cloud VPS, offline while work was carried out to address the vulnerabilities. The action was intended to reduce risk until affected environments could be patched safely. Service owners and volunteers may need to update systems they operate.
AI-assisted discovery brings new attention to cyber risk
OpenAI said a researcher known as Calif identified a critical flaw with assistance from GPT-5.6 Sol through the Patch the Planet initiative. Cybersecurity company Wiz independently discovered and reported both vulnerabilities, while PHP maintainers led the remediation and release of fixes. The coordinated disclosure highlights how AI tools can help security researchers identify serious software weaknesses, while also underscoring concerns that similar capabilities could be misused by attackers.
Which PHP versions should organizations update?
The NHS England Digital advisory lists patched releases including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should consult the official PHP security announcements and their operating-system or software vendor’s guidance to confirm the correct update for their environment. PHP 8.1 and older branches are end-of-life and should be migrated to a supported version rather than treated as receiving routine security fixes.
What should website owners do now?
Security agencies urge organizations to identify all PHP-based applications, prioritize internet-facing systems and install the relevant security updates as soon as possible. If an exposed service cannot be patched immediately, temporarily isolating it from the internet can reduce risk. Teams should also check vendor advisories for products that bundle PHP, review relevant logs for suspicious activity and confirm that updates have been applied successfully.
