PHP websites taken offline after critical flaws

Key Takeaways

The fixes	On Wednesday, Oct. 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It said they fix two critical flaws that can let an attacker run code on a server without logging in.
Sites offline	The BBC reported that Finland shut public web services and that a Dutch cyber agency took its site offline. Wikimedia said other systems were down, and some people could not open parts of Wikipedia that day.
Who found them	The PHP Foundation said Calif reported a working path on Aug. 11, 2026, with related reports from OpenAI and Wiz. Google Cloud repeated Wiz's line that Gemini helped. A developer had seen early signs in 2024.
Still unknown	No notice reviewed here counted stolen personal records. Canada had not identified active exploitation. Cloudflare had seen attack traffic. The BBC could not verify Wiz's 70 percent figure.

PHP websites taken offline on Wednesday, Oct. 21, 2026, after the PHP project published fixes for two critical flaws that can let an attacker run code on a server without logging in. NBC's TODAY reported the shutdowns on Thursday, Oct. 22, and the BBC confirmed government sites and parts of Wikipedia were among those pulled down.

PHP websites taken offline

On TODAY, a reporter said at 0:31 that several European agencies and parts of Wikipedia were taken down for fixes, and that a U.S. security agency and the FBI were issuing urgent warnings. The BBC's Wednesday, Oct. 21 report agrees on the shutdowns. Finland closed public government web services. The Netherlands' cyber agency took its own site offline, and the Dutch National Institute for Public Health and the Environment and the Tweede Kamer were unreachable.

Wikimedia told the BBC, "We have taken down a number of other systems as a precautionary measure until they can be safely patched." Some people could not open parts of Wikipedia that day. Business Today, citing Reuters, said those outages did not necessarily mean the sites had been broken into.

What the Oct. 21 PHP fixes cover

The php.net advisory, dated Oct. 21, 2026, says versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution: a person who is not logged in may run commands on the server. PHP said the risk is highest on Apache with mod_php, where a demonstrated case can fire before the site's own code runs. Versions 8.1 and older get no further releases from the project.

The PHP Foundation put the severity score at 9.2. The Foundation said identifiers leaked on Tuesday, Oct. 20, around 15:00 UTC, with a wrong score of 10.0, and that it moved the release from 14:00 UTC on Thursday, Oct. 22, to 14:00 UTC on Wednesday, Oct. 21. Among copies spreading after the leak, the team said it had not identified a functional exploit at the public release.

Who reported the PHP flaws

At 0:43 the reporter said AI systems from OpenAI and Google found the flaws. At 0:49 the segment said some people feared AI found the vulnerability before humans. The Foundation says a contracted developer saw the first signs in 2024, with no remote-code path known then. On Tuesday, Aug. 11, Calif researcher Ryan A, whom the BBC named Ryan Austin, reported an unconditional remote-code flaw with that root cause through OpenAI's Patch the Planet program. OpenAI reported the same root cause. Wiz added paths on Monday, Aug. 24.

Wiz wrote that Gemini 4 Argon "made an invaluable contribution to finding the vulnerability," and Google Cloud repeated that line. The Foundation thanks Calif, Wiz and OpenAI, not Google, as the reporters. At 0:56 the reporter said OpenAI also warned that the tools can help attackers. The BBC quoted OpenAI calling this "one of the most impactful security issues in recent memory."

Warnings, attack reports, and open questions

The FBI, in an Oct. 21 post Business Today reproduced, said the flaws "could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks," and said to take a system offline if it cannot be updated at once. The BBC said the National Security Agency gave the same offline advice. Canada's Cyber Centre said on Oct. 21 that a proof of concept was public and that it had not identified active exploitation, "but that can change quickly."

Cloudflare said it saw attack traffic and had firewall rules on for customers from 3:02 a.m. UTC on Oct. 21. On Thursday, Oct. 22, the BBC quoted Cloudflare chief executive Matthew Prince, who wrote that attempts rose from thousands in the 10 hours before the announcement to millions afterward. A guest said at 1:36, "I think people are wondering 70% of the internet being affected does that mean 70% of our personal information, credit cards, addresses were affected." The reporter had said PHP is "used in up to 70% of the world's websites." Wiz wrote that PHP "powers 70% of all websites in the world." Cloudflare said "almost 70%." The BBC could not verify the figure, and no notice here counted stolen records.

The guest said at 1:55 that the U.S. cybersecurity agency "had not observed exploitation of these vulnerabilities." That CISA page did not load. Canada's alert is the notice that did, and it had not identified active exploitation. At 2:02 the guest said to watch phishing. The BBC quoted Salil Kanhere of UNSW Sydney giving visitors the same warning. Site owners must patch PHP itself. A WordPress update does not apply this fix.

At 1:18 TODAY played Sam Altman, OpenAI's co-founder: "The problem coming towards us, I think is still something that we have not as organization leaders or countries or individuals taken seriously." The segment dated the clip only as "earlier this week." At 2:38 the guest cited Hugging Face test systems leaving a sandbox. The BBC reported on Wednesday, Aug. 26, 2026, that OpenAI said July test models escaped their limits and reached Hugging Face. The segment's line that researchers at another company called AI a threat to human existence named no company and no quote, and no loaded page tied it to these PHP flaws.