'Critical vulnerabilities': Govt websites in Europe shut down over PHP security scare
As reports of hacking attempts emerged, the FBI warned that the flaws could allow cybercriminals to remotely take control of vulnerable servers and access sensitive data
- Oct 21, 2026,
- Updated Oct 21, 2026 10:31 PM IST
Government websites across parts of Europe went offline on Wednesday after two critical security vulnerabilities were discovered in PHP, a programming language that powers millions of websites worldwide, Reuters reported.
As reports of hacking attempts emerged, the FBI warned that the flaws could allow cybercriminals to remotely take control of vulnerable servers and access sensitive data.
Government agencies in the Netherlands and Finland were among those that temporarily shut down websites as a precaution while developers rushed to release emergency security updates.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each been assigned a critical severity score of 9.2 out of 10.
PHP developers released fixes on Wednesday, but cybersecurity authorities warned that websites remaining on vulnerable versions could still face attacks.
FBI warns of remote hacking risk
The FBI's Cyber Division issued an urgent advisory, warning that the vulnerabilities could expose sensitive information and compromise networks.
"Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks," the FBI said on X.
Remote code execution means attackers could potentially run malicious commands on a vulnerable website's server without needing to log in.
The FBI urged organisations to identify where PHP is running, prioritise internet-facing systems and install the latest security updates.
It also advised taking affected systems offline if immediate patching was not possible. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," the agency said.
The FBI further urged website operators to monitor servers for unusual activity, including PHP processes unexpectedly launching command shells or downloading files. Organisations that discover signs of a breach should isolate affected systems, preserve server logs and report the incident to the authorities, it said.
Government websites taken offline in Europe
According to Reuters, government agencies in the Netherlands and Finland were among those that temporarily took websites offline ahead of the emergency security fixes.
The precautionary shutdowns followed warnings that attackers could exploit the vulnerabilities before organisations had time to update their systems.
The outages were preventive measures and did not necessarily mean the affected government websites had been successfully hacked.
PHP is one of the most widely used programming languages for running websites. It works behind the scenes, processing requests, managing databases, and generating content displayed to users.
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said in a blog post, according to Reuters.
The widespread use of PHP means vulnerabilities in its core software can potentially affect websites across industries, including government services, online shopping and publishing.
However, not every website using PHP is necessarily exposed in the same way. The risk depends on the software version, server configuration, and security protections in place.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine
Government websites across parts of Europe went offline on Wednesday after two critical security vulnerabilities were discovered in PHP, a programming language that powers millions of websites worldwide, Reuters reported.
As reports of hacking attempts emerged, the FBI warned that the flaws could allow cybercriminals to remotely take control of vulnerable servers and access sensitive data.
Government agencies in the Netherlands and Finland were among those that temporarily shut down websites as a precaution while developers rushed to release emergency security updates.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have each been assigned a critical severity score of 9.2 out of 10.
PHP developers released fixes on Wednesday, but cybersecurity authorities warned that websites remaining on vulnerable versions could still face attacks.
FBI warns of remote hacking risk
The FBI's Cyber Division issued an urgent advisory, warning that the vulnerabilities could expose sensitive information and compromise networks.
"Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks," the FBI said on X.
Remote code execution means attackers could potentially run malicious commands on a vulnerable website's server without needing to log in.
The FBI urged organisations to identify where PHP is running, prioritise internet-facing systems and install the latest security updates.
It also advised taking affected systems offline if immediate patching was not possible. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," the agency said.
The FBI further urged website operators to monitor servers for unusual activity, including PHP processes unexpectedly launching command shells or downloading files. Organisations that discover signs of a breach should isolate affected systems, preserve server logs and report the incident to the authorities, it said.
Government websites taken offline in Europe
According to Reuters, government agencies in the Netherlands and Finland were among those that temporarily took websites offline ahead of the emergency security fixes.
The precautionary shutdowns followed warnings that attackers could exploit the vulnerabilities before organisations had time to update their systems.
The outages were preventive measures and did not necessarily mean the affected government websites had been successfully hacked.
PHP is one of the most widely used programming languages for running websites. It works behind the scenes, processing requests, managing databases, and generating content displayed to users.
"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," cybersecurity company Huntress said in a blog post, according to Reuters.
The widespread use of PHP means vulnerabilities in its core software can potentially affect websites across industries, including government services, online shopping and publishing.
However, not every website using PHP is necessarily exposed in the same way. The risk depends on the software version, server configuration, and security protections in place.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine