Multiple government and public websites across Europe were taken offline after two critical vulnerabilities were found in PHP. The flaws allow attackers to execute arbitrary code on vulnerable servers remotely and without authentication (no password or user account required).
Scope: why many sites are at risk
PHP is one of the most widely used server-side web languages: according to W3Techs, about 70 percent of identifiable websites run on PHP. WordPress, which itself powers roughly 40 percent of all websites, is also PHP-based and underpins blogs, small business sites, government portals, online stores and news sites.
Because PHP and WordPress are so prevalent, the vulnerabilities could affect a broad range of services — from well-maintained infrastructure to small sites hosted on shared platforms.
Details of the vulnerabilities and discovery timeline
Both vulnerabilities received a 9.2 score on the 10-point CVSS v4.0 scale, indicating unauthenticated remote code execution. The first flaw was discovered by researchers at Calif using the OpenAI GPT-5.6 Sol model and was reported to the PHP developers on 11 August 2026. The second was independently found by Wiz (part of Alphabet) using AI and reported on 24 August 2026.
Wiz said the issues stem from fundamental bugs that have existed in the codebase for decades, and that demonstrating exploitability required a sequence of actions "practically at the edge of what human researchers can achieve." The company described the vulnerabilities as among the most severe ever found in PHP.
Mitigation and responses
CERT-EU (the EU’s cybersecurity team) urged organisations that cannot immediately apply patches to take affected sites offline. PHP developers announced on Wednesday that patches for both vulnerabilities would be released.
Cloudflare’s Chief Technology Officer reported that initial exploitation attempts have already been observed. Wordfence, a developer of WordPress security tools, warned that the usual automatic update mechanisms may not deploy these fixes, so administrators must verify and apply the patches manually when necessary.
Extra challenges for smaller operators
The situation is particularly difficult for smaller site operators who often lack dedicated cybersecurity staff. Many run sites on shared hosting where they do not control the server and may not even know who updates PHP or when updates occur. That complicates rapid response and remediation.
Consequences and lessons
In the short term, the visible effects include offline government portals and restricted services as a risk-reduction measure. Over the medium term, the incidents highlight the importance of ongoing security hygiene for core software components such as PHP, and the need for clear update responsibilities in shared hosting environments.
Source: Reuters. An AI assistant participated in preparing this article; final editing and verification were performed by our journalist.
