Governments take websites offline after critical PHP flaws
Public bodies in Australia and Europe pulled sites while they patched two flaws in software that runs much of the web. Accounts of whether attackers are already using the flaws differ.
Government websites in Australia, the Netherlands, Finland, Denmark and France were taken offline as public bodies moved to fix two critical flaws in PHP, widely used website software. Several of the outages were described as a precaution, ABC News reported.
On 21 October the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, "that can allow unauthenticated remote code execution". In plain terms, attackers could run commands on an affected server without logging in. The project said all PHP installations serving web requests are at risk and that "updating is the only safe choice". PHP 8.1 and older no longer receive updates from the project, although its security team published minimal fixes for PHP 7.4, 8.0 and 8.1 for people building from source. On 23 October the project advised setting session.upload_progress.enabled=0 until its next regular bugfix release, "to fully protect from an unlikely RCE vector", a separate flaw tracked as CVE-2026-115560.
The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) told organisations to patch immediately, "prioritizing internet-facing systems", and to take PHP-based systems offline if they cannot update at once or still run PHP 8.1 or earlier. CISA says the pair is known as "php2shell". Two other US agencies, the NSA and the FBI, joined CISA in urging fixes, according to Nextgov/FCW.
Who went offline
In Australia, "a number of federal government and local council websites went dark Wednesday night for security updates", including abs.gov.au and cyber.gov.au, Government News reported. A spokesperson for Home Affairs Minister Tony Burke said, according to ABC News: "Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability." New South Wales Minister for Digital Government Jihad Dib said Cyber Security NSW "is working with departments and agencies to ensure updates are applied to any affected websites", and Government News reported that no government agencies had reported any data breaches.
In Europe, websites of the Dutch parliament, cybersecurity authorities and data protection regulator were taken offline as a precaution, as were Finnish government services. Finland's state IT services provider Valtori said government public network services had been taken offline, Danish municipal IT company Kombit said it had shut down several services, and France's Interior Ministry said it had temporarily taken local government administrative websites offline, according to ABC News.
Conflicting accounts of attacks
Reports differ on whether the flaws are being exploited. CISA said, in an alert updated on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". Cloudflare's chief technology officer, Dane Knecht, said: "We are seeing early attacks emerging and are updating mitigations as new vectors show up," ABC News reported. Jake Knott, head of threat intelligence at watchTowr, said, according to The Register, that "watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities", adding: "Whilst nobody has been successful to date, we don't expect that will last long."
For the Australian sites, an Australian Signals Directorate (ASD) spokesperson said: "There is no indication that these websites have been impacted by the vulnerability," according to Government News.
Accounts of how the flaws were found also vary. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities, Nextgov/FCW reported. ABC News wrote that the issue was first discovered using AI, according to a Google-owned cybersecurity agency it did not name.
What is not yet known
None of the reports gives a full count of government sites taken offline or a date for when they will all return. In the United States, a Nextgov/FCW analysis using Shodan found roughly 900 results tied to federal, state and local government websites showing signs of PHP use; the outlet noted that many listed older versions and the data may not reflect recent updates.
Editor-in-chief,
Fazilat Ghobadinezhad is IQGov's editor-in-chief. She decides what IQGov covers and edits its stories. IQGov's stories are researched and drafted by AI agents to our editorial rulebook, checked against their sources by a separate fact-checking agent, and approved before publication. Every fact links to its source.
