PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out

In brief

• PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix CVE-2026-109618 and CVE-2026-109619, two flaws rated 9.2 out of 10 that allow unauthenticated remote code execution.
• Finland, the Netherlands, and France took government websites offline as a precaution after details leaked early and Cloudflare reported attacks hours before the fix shipped.
• Regular users have nothing to install; the fix falls on website owners and hosting companies, and PHP 8.1 and older get no official release.

If you’ve been online at all today, you’ve seen the panic: a critical vulnerability is threatening to “pwn” just about every website on the planet.

Finland just started unplugging government websites on Wednesday, the NSA is recommending all organizations using PHP to shut down their sites, and the Netherlands and France did the same. And no, it wasn't a cyberwar.

The culprit was PHP, a programming language most people have never heard of. You've almost certainly used it today, though: it runs about 70% of all websites whose server-side language is known, according to W3Techs.

PHP is the software working behind the curtain on a website's server—the computer that stores the site and builds each page you ask for. Every WordPress site, for example, sits on a PHP server, per WordPress security firm Wordfence.