PHP security crisis live — all the latest news as issues affect websites across the world

"A finite window" to patch and protect

This is clearly an alarming issue, one which will likely affect companies of all sizes across the globe, so how quickly should businesses look to respond? 

"This is a stake-in-the-ground moment for CISOs around the world," says Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.

"Organisations of every size have a finite window to shore up their cyber defences, because threats now operate at machine speed. Patch fast, know your attack surface and limit the blast radius, because that window is closing. If we don't act now, we will see more organisations forced to take their sites offline while they scramble to fix what should have been secured long ago."

Open source worries

The issue may raise wider concerns about the role of open source software in propping up some of the most integral parts of the global information network - as the very thing that makes it so unique also leaves it vulnerable to flaws and security concerns.

"Much of the critical software running the world is also the least visible. Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," says Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.

"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."

"The ripple effects from vulnerabilities in foundational software like PHP can extend across entire industries. This makes it critical to have a trusted software source that helps manage this risk and, ideally, quickly responds to these new threats as they emerge."

PHP fixes are out now - so get patching

As we've covered on TechRadar Pro this morning, PHP has now released its emergency fixes for users to download.

The issues are listed as CVE-2026-109618 and CVE-2026-109619 - the former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.

Wondering how this affects you?

While most websites are back up and running, there were some that were taken offline yesterday after the news broke. Did you notice anything amiss? Tell us in the comments above, or vote in the poll to let us know what you normally do when you hear about cybersecurity issues in the news.

What has actually happened?

It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.

Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources.

So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.

Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now.

What is PHP?

PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.

PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.

News of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems.

The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.

PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."