Critical PHP flaws force European government sites offline
SingTao · 2 SOURCESabout 5 hours ago5 MIN
Summary
Two newly disclosed PHP vulnerabilities have prompted urgent action by governments and cybersecurity agencies after researchers showed they could be exploited through unauthenticated web requests before application code starts running. The Dutch government took several public-service websites offline as a precaution, while Finland also suspended government public network services, underscoring the breadth of concern beyond commercial websites
Key Points
- The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 out of 10 and could enable remote code execution by unauthenticated attackers
- PHP said all installations handling web requests should assess exposure, with Apache deployments using mod_php described as the highest-risk configuration
- Security updates were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while PHP 8.1 and older branches are no longer under regular official support.
- The Netherlands said DigiD, MijnOverheid, Overheid.nl and even the Dutch National Cyber Security Centre website were temporarily taken offline on October 21 local time
- Hong Kong information technology sector veteran Francis Fong Po-kiu (方保僑) urged administrators to inventory systems, patch immediately, and shut down or switch to maintenance mode if rapid remediation is not possible
Why It Matters
For Hong Kong organisations, the immediate issue is not only public-facing websites but also software products and network devices that may embed PHP and therefore be overlooked during emergency checks. With Cloudflare already seeing early attack activity and some operators still on unsupported versions, delaying patching could leave local servers exposed soon after technical details spread.