Two flaws rated 9.2 prompt European website shutdowns as PHP releases updates
Key Facts
The PHP project announced updates on October 21, 2026, to fix two critical vulnerabilities that allow unauthenticated remote code execution, as government, school and hospital websites in Europe shut down as a precaution during the crisis. The updates cover versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which the project said address the two security flaws. Britain's health authority assigned each vulnerability a severity score of 9.2 under version four of the Common Vulnerability Scoring System. The first flaw involves memory corruption when memory is exhausted, while the other stems from stale global state within the runtime, according to the authority's advisory. Reuters reported that the European websites were taken offline on Wednesday as a precaution against risks associated with the language. The crisis thus combined the release of runtime fixes with the suspension of online services at government, educational and healthcare institutions.
Assessing the potential for exploitation, the Canadian Centre for Cyber Security said open-source reports indicated that a proof of concept was available. Its advisory added that "no active exploitation had been observed at the time the advisory was issued," tying that assessment to the warning's publication time. Red Hat, meanwhile, said reliable exploitation of the memory-exhaustion flaw required precise technical conditions. It said exploitation required "precise heap manipulation and precise timing." That description concerns the flaw caused by memory corruption when memory is exhausted, which Britain's health authority classified as capable of enabling remote code execution.
The security warnings come amid widespread use of PHP to run websites. The language accounted for 69.3% of websites whose server-side programming language was known, according to W3Techs statistics dated October 22, 2026. By runtime version, Mallory said its recount by exact version showed that 73.5% of services disclosing their PHP version used version 8.1 or earlier. Mallory's figures cover services that disclose their version, while W3Techs measures the language's use among websites whose server-side language is known. Google Cloud said branches 8.1 and earlier had reached end of support and that the PHP project no longer issued fixes for them. For applications built on the language, Luxembourg's Computer Incident Response Center warned against relying solely on content management system updates. It said updating WordPress, Drupal, Joomla or any other PHP-based application was insufficient on its own to address the problem. It stressed the need to update the underlying PHP runtime that runs those applications.
The PHP Foundation acknowledged a failure in managing the security response, describing the delay in delivering a fix as a "structural failure." The foundation attributed this to decision-making processes within the security team and a lack of resources available to it, in its October 21, 2026, statement on the security release and strengthening the project's security. In the stock market, Cloudflare shares rose 5.52% during trading on Wednesday, October 21, according to Investing's coverage published during the session. The shares traded at $307.79 at the time of the report. The intraday move came on the same day that the PHP project announced the patched releases and European websites suspended services as a precaution.
Following the October 21 updates, temporary mitigations remain part of the response recommended by security agencies and system vendors until the appropriate fixes are applied. Britain's National Cyber Security Centre said that if temporary measures could not be implemented, or would take too long to implement, taking the system out of service should be considered. Its recommendation stated that "consideration should be given to taking the system out of service" if either condition applied. Palo Alto Networks, for its part, said it would address the issue in upcoming PAN-OS releases. The company recommended applying the workaround and mitigations until system releases containing the fix became available.