Websites are being taken offline because two critical security flaws were found in PHP, the programming language behind much of the web, and cyber-security agencies told organisations that cannot install the fix right away to consider shutting affected systems down until they can.
The PHP Foundation released a fix on Wednesday, October 21, 2026, but only for the latest versions, and users of PHP 8.1 or older are being urged to upgrade. The flaws were found by researchers at the firms Calif and Wiz using AI made by OpenAI, and they had gone undetected for more than a decade. CERT-EU said the risk scores point to possible unauthenticated remote code execution, meaning attackers could run their own code on a server without logging in, and that all versions back to PHP 5 could be affected. The UK’s National Cyber Security Centre and the US National Security Agency advised taking systems offline if they could not be patched. Finland shut its government’s public web services, and Cloudflare said it was seeing early attacks. Because PHP powers WordPress, Drupal, Joomla and Magento, site owners should update PHP and check for signs of a break-in.
Image: Wikimedia Foundation servers, Victor Grigas, CC BY-SA 3.0, via Wikimedia Commons.