AI-found PHP flaws take government sites offline: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

Government websites in the Netherlands, Denmark, Finland and France went dark on October 21 after the PHP project disclosed two critical remote code execution flaws, according to a report carried by RTE. The security firm Wiz said it found them using AI tools. Any business whose website runs on PHP has a patch to apply.

The flaws

The PHP project's advisory describes two bugs, both scored 9.2 on the CVSS v4.0 scale. CVE-2026-109618 is a memory-handling error: when PHP runs out of memory mid-request, cleanup can treat half-built data as valid. CVE-2026-109619 is stale state left over from a previous request on the same worker. Either can allow unauthenticated remote code execution, meaning no password is needed.

PHP says every installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, with a demonstrated exploit that fires before any application code runs.

Who went offline

• Netherlands: the National Cyber Security Centre took its own site down. The Port of Rotterdam, Overheid.nl, the five largest political parties' sites and several hospital sites followed, per RTE.
• Denmark: Kombit shut several services, including a national school communication platform.
• Finland: Valtori took government network services offline as a precaution.
• France: the Interior Ministry put all its websites into preventive maintenance.

Wiz said the bugs had sat in the codebase for more than a decade and would have been very hard for a human to exploit, and that AI removed that barrier. Security researchers quoted by RTE warned of a race to exploit, since attackers can study a public patch to find the weakness.

What to do

1. Find out whether your site runs PHP. Many content management systems and online store platforms do. Ask your web host or developer if you are unsure.
2. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer get updates from the project, so ask your vendor for a backported fix or upgrade. Linux vendors received patches in advance.
3. On shared hosting, you depend on the host. Ask in writing when they will patch.
4. If you cannot update at once, PHP lists partial mitigations, such as a low post_max_size and disabling session.upload_progress. It states these reduce exposure but do not make a server safe.
5. Test after updating, since fixes can break other things, and watch logs for unusual requests.

The practical risk for a small shop is a hijacked site that leaks customer data or serves malware, so the cost of an hour of downtime for patching is small by comparison. More on how thin the margin is for small firms in our small-business coverage.

Sources: PHP.net security advisory, October 21, 2026; RTE. This is general information, not security advice for your specific systems.