WHAT HAPPENED On Wednesday, October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in PHP, a widely used programming language. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 on the CVSS severity scale. Governments, broadcasters, schools, hospitals and businesses patched their systems, and many took websites offline as a precaution. Germany's federal IT provider, ITZBund, took several government sites offline. Kenya's ICT Ministry and ICT Authority issued an advisory on October 21 directing public institutions to patch or take platforms offline. In France, tax services on impots.gouv.fr were placed in maintenance, and all préfecture sites were taken offline at the request of the national cybersecurity agency, ANSSI. Météo France and the CNIL also went offline. In Britain, the websites of The Traitors, Doctor Who and the Metropolitan Police were taken down. In Japan, Prime Minister Sanae Takaichi urged website owners to check whether their sites run on PHP and apply the fix. WHO FOUND THE FLAWS The security firm Calif found the flaws in August 2026 using OpenAI's GPT-5.6 Sol model under OpenAI's "Patch the Planet" program. Wiz, a Google-owned security company, independently found them weeks later using its Atlas system with Gemini 4 Argon and GPT-5.6 Sol. OpenAI states that an internal researcher also found the problem. Reports state the flaws went undetected for more than a decade, in code dating to the PHP 5 series, first released in 2004. WHY THE PATCH CAME EARLY The PHP Foundation had planned a coordinated disclosure so fixes could reach system administrators before the details became public. Details leaked on Hacker News on Tuesday, and the emergency release followed on Wednesday. A proof-of-concept exploit circulated afterward. Matthew Prince, CEO of Cloudflare, posted on X on October 22 that his network saw thousands of exploitation attempts in the 10 hours before public disclosure. He wrote that the number rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions afterward. SEVERITY ASSESSMENTS PHP Foundation security engineer Volker Dusch described it as the most severe PHP issue in more than a decade and compared it to Heartbleed (2014). Wiz compared it to Heartbleed and Log4Shell. The U.S. National Security Agency stated that the flaws offer a direct path to a server's file system or database. The NSA, Britain's NCSC, CERT-EU and agencies in Australia and Japan advised organizations that could not patch immediately to take systems offline. PHP BACKGROUND What PHP is PHP is a programming language that runs on web servers, the computers that deliver websites to browsers. When a browser requests a page from a PHP-based site, the server runs a PHP program that gathers data, such as account details, product listings or a blog post, and builds the page. The server sends the finished page to the browser as HTML. Visitors see the output, not the PHP code. This is called server-side programming. Origins Rasmus Lerdorf, a Danish-Canadian programmer, created PHP in 1994 and 1995 as a set of tools to track visitors to his online resume. It was named "Personal Home Page Tools," which is the origin of the acronym PHP. It was later renamed "PHP: Hypertext Preprocessor," a recursive acronym. Major releases: PHP 3 in 1998, PHP 5 in 2004, PHP 7 in 2015 and PHP 8 in 2020. Usage PHP is free, open source and supported by most web hosting plans. It powers WordPress, Drupal, Joomla, Magento and MediaWiki, the software behind Wikipedia. Frameworks such as Laravel and Symfony are built on it. Facebook was originally written in PHP. Wiz estimates that about 70 percent of websites run on PHP; the BBC could not independently verify that figure. The analytics tracker W3Techs reports about 75 percent of sites where the server-side language can be identified. PHP's share of websites has declined gradually as other languages and platforms have grown. KEY TERMS Vulnerability: a flaw in software that an attacker can exploit. CVE (Common Vulnerabilities and Exposures): a public catalog of identifiers for known security flaws. CVE-2026-109618 and CVE-2026-109619 identify the two flaws in this story. CVSS (Common Vulnerability Scoring System): a 0-to-10 severity scale. Scores of 9.0 to 10.0 are classed as critical. Remote code execution (RCE): a flaw that lets an attacker run commands on a server from a remote location. Both flaws allow unauthenticated RCE, meaning no login or account is required. Proof of concept: example code demonstrating how a flaw can be exploited. Patch: a software update that fixes a flaw. Coordinated disclosure: the practice of withholding details of a flaw until a fix is available. WHAT THE FLAWS PERMIT A successful remote code execution attack can give an attacker control of a server, access to its file system and database, the ability to alter or deface a website, installation of persistent backdoors, and use of the server to attack other systems. PATCHING STEPS FOR SITE OWNERS 1. Determine whether the site uses PHP. WordPress, Drupal, Joomla and Magento sites do. 2. Check the PHP version through your hosting provider, or by running "php -v" with command-line access. 3. Update to a fixed release. The emergency releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 4. If patching is not immediately possible, follow official guidance, which may include taking the site offline. 5. Branches that no longer receive security updates require an upgrade to a supported version. 6. Update the content management system, plugins and themes, and review server logs for suspicious activity. SOURCES REPORTED Reuters, BBC, The Next Web, RTL Today, LBC, The Local (Germany and France), RTL France, Tuko, Kenyans.co.ke, DevDiscourse, WION, Graphic Online and ASEAN Now. FIVEO1 PO Box 312786 Avalon, California 90704 Evan Winter District 69, California