Critical PHP vulnerabilities force CERT-EU to recommend taking websites offline
The EU’s cybersecurity response team, CERT-EU, has advised organisations to consider taking unpatched PHP websites offline due to two critical vulnerabilities. The flaws, rated 9.2 on the CVSS scale, could enable unauthenticated remote code execution. Patches are expected on October 21, 2026, at 14:00 UTC.
Editor, Lazyfounder
30 SEC SUMMARY
- CERT-EU has urged organizations to take unpatched PHP websites offline due to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- The vulnerabilities are rated 9.2 on the CVSS scale, enabling unauthenticated remote code execution.
- Patches will be released by the PHP project on October 21, 2026, at 14:00 UTC.
- No active exploitation has been confirmed, but organizations are advised to patch or isolate vulnerable systems.
- PHP powers major platforms like WordPress, Drupal, Joomla, and Magento, amplifying the risk.
TABLE OF CONTENTS
KEY HIGHLIGHTS
- CERT-EU and the Australian Cyber Security Centre have advised organizations to consider taking unpatched PHP websites offline due to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- The vulnerabilities are rated 9.2 out of 10 on the CVSS scale, indicating a high risk of unauthenticated remote code execution.
- Patches will be released by the PHP project on October 21, 2026, at 14:00 UTC, one day earlier than planned due to public claims about the flaws.
- PHP powers a significant portion of the web, including platforms like WordPress, Drupal, Joomla, and Magento.
- No active exploitation of the vulnerabilities has been confirmed as of the latest advisory.
Critical vulnerabilities identified in PHP
CERT-EU has issued an urgent advisory recommending that organisations consider taking unpatched PHP websites offline due to two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities are rated 9.2 out of 10 on the CVSS scale, indicating a severe risk of unauthenticated remote code execution, according to The Next Web.
The flaws could allow attackers to run malicious code on a server over the internet without requiring authentication. This could lead to data theft, website defacement, or full server compromise. Every PHP version from PHP 5 onward may be affected, though the PHP project has not yet specified which versions are vulnerable or which releases will include fixes.
Patches scheduled for October 21
The PHP project is set to release patches for the vulnerabilities at 14:00 UTC on October 21, 2026. The release has been moved forward by a day due to claims about the flaws spreading online. According to The Next Web, PHP stated it could expedite the release if details became public or attacks began, though no confirmed exploitation has been reported so far.
CERT-EU’s advisory was based on social media posts rather than direct information from the PHP project. Researchers at the security firm watchTowr have reportedly reproduced one of the bugs, raising concerns about potential exploitation.
Guidance for organisations
CERT-EU has advised organisations to identify all PHP applications in their environment and prepare to patch them immediately once updates are available. If patching is not feasible, isolating vulnerable systems from public networks is recommended as an alternative measure.
The Australian Cyber Security Centre (ACSC) has issued similar guidance, underscoring the global significance of the vulnerabilities. Given PHP’s widespread use—powering platforms like WordPress, Drupal, Joomla, and Magento—the flaws pose a risk to a large portion of the web.
Security firms like Huntress and GoDaddy are likely to monitor the situation closely, given their involvement in web infrastructure and hosting services.
Historical context of PHP vulnerabilities
PHP has faced critical vulnerabilities in the past. In 2019, a bug in PHP 7 allowed hackers to take control of web servers, highlighting the potential impact of such flaws on widely used software.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
For founders and operators, this situation underscores the fragility of relying on widely used but aging infrastructure like PHP. While the immediate priority is patching, the incident serves as a reminder to audit dependencies regularly and have contingency plans for critical vulnerabilities. The recommendation to take systems offline—even temporarily—shows how seriously cybersecurity agencies are treating this threat, and organisations must be prepared to act swiftly.
The early release of patches also highlights the importance of staying connected to developer communities and security researchers. In this case, public discussion of the vulnerabilities accelerated the fix, but it also increased the risk of exploitation. Balancing transparency with caution is a delicate act, and organisations should ensure their security teams are looped into official updates from projects like PHP.
Key takeaways
- Act immediately: Identify all PHP applications in your infrastructure and prepare to patch them simultaneously when updates are released.
- Isolate if necessary: If patching isn’t feasible, consider taking vulnerable PHP websites offline or isolating them from public networks to mitigate risk.
- Monitor developments: Stay updated on official communications from PHP and cybersecurity agencies like CERT-EU and ACSC for further guidance.
- Prioritize high-risk systems: Focus on platforms like WordPress, Drupal, and Magento, which rely on PHP and could be prime targets for exploitation.
- Leverage security research: Follow insights from firms like watchTowr and Huntress to understand the technical implications of the vulnerabilities.
FAQ
What are the two vulnerabilities in PHP?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They are rated 9.2 out of 10 on the CVSS scale, indicating a severe risk of unauthenticated remote code execution.
When will patches for the PHP vulnerabilities be released?
Patches are scheduled to be released by the PHP project on October 21, 2026, at 14:00 UTC.
Why is CERT-EU recommending organisations take websites offline?
CERT-EU has advised organisations to consider taking unpatched PHP websites offline due to the high severity of the vulnerabilities, which could allow attackers to execute remote code without authentication.
Are the vulnerabilities being actively exploited?
As of the latest advisory, no active exploitation of the vulnerabilities has been confirmed.
Which platforms could be affected by these vulnerabilities?
PHP powers a significant portion of the web, including platforms like WordPress, Drupal, Joomla, and Magento, all of which could be affected by the vulnerabilities.
Related on Lazyfounder
Sources
- The Next Web · 2026-10-21
EU cybersecurity team says unpatched PHP sites may need to go offline
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
