Govs, Nintendo take sites offline as AI-driven attacks target critical PHP flaws
The PHP team issued urgent fixes for two severe flaws, prompting governments and companies to take sites offline while exploitation attempts emerge.
Key points
- PHP maintainers released patches for CVE-2026-109618 and CVE-2026-109619, both rated critical with 9.2 severity scores.
- Governments in Europe, Canada, and Asia took websites offline as a precaution, while Nintendo and others halted services.
- Security firms report early in-the-wild exploitation attempts using AI-generated proof-of-concept code targeting PHP servers.
The maintainers of the PHP scripting language released urgent security patches on Tuesday evening to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP Foundation warned users to prepare for immediate upgrades, noting that versions older than PHP 8.1 no longer receive updates from the project.
According to The Record, the vulnerabilities carry CVSS severity scores of 9.2 out of 10, a rating the PHP team classified as critical. The security team urged all PHP users to upgrade as soon as the release was available. Dozens of government agencies issued urgent warnings throughout Tuesday evening and Wednesday morning, instructing website maintainers to apply the fixes immediately.
Early exploitation and global response
Security researchers are already observing active exploitation attempts in the wild. Dane Knecht, CTO of Cloudflare, stated that the company is seeing emerging attacks and has released stopgap mitigations for some customers. Jake Knott, head of threat intelligence at watchTowr, reported observing exploitation using proof-of-concept tools created with AI assistance. Knott noted that while attackers have not been successful yet, he expects that status to change quickly.
Several nations took preventive action by taking government websites offline. Reuters reported that the Netherlands, Denmark, France, and Finland took down at least some sites. Evan Solomon, Canada’s Minister of Artificial Intelligence and Digital Innovation, announced on X that Canadian government sites were temporarily offline. The European Union, Germany, Japan, Australia, the U.K., and the Netherlands all issued local warnings. Large organizations, including Nintendo, also took services offline to address the bugs, which are being referred to as “PHP2Shell.”
Widespread exposure and legacy risks
PHP underpins a vast portion of the internet, with estimates suggesting more than 70% of websites use the language. Experts at watchTowr noted that enterprise networks commonly run PHP-based content management systems and internal tools, meaning servers often handle customer data and business logic reachable from the internet. Tiffany Farriss, interim CEO of the Drupal Association, stated that all servers using any PHP version released in the last 20 years are vulnerable.
Experts expressed deep concern that millions of PHP-backed websites run ancient versions that likely cannot be updated. Joviane Jardim, a senior security researcher at Detectify, said many organizations only discover forgotten PHP servers when an attacker finds them. The White House stated it was made aware of the issue on Friday. The Cybersecurity & Infrastructure Security Agency encouraged organizations to update to the new patch from the PHP Foundation.
What should you do?
Organizations should immediately verify if their infrastructure runs PHP and check for the availability of the latest security release. If running PHP 8.1 or older, users should note that these versions no longer receive updates from the PHP project. Administrators should monitor logs for signs of exploitation attempts, particularly those using AI-generated proof-of-concept tools. Once the vendor provides an update, apply it promptly to mitigate the critical risk.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: PHP
- Identify all servers and applications running PHP within your environment to determine exposure.
- Verify if your PHP version is 8.1 or older, as these versions no longer receive official updates.
- Monitor network traffic and server logs for unusual activity or signs of exploitation attempts.
- Apply the latest security patch from the PHP Foundation as soon as it is available for your supported version.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are PHP versions older than 8.1 still supported?
No, PHP 8.1 and older versions no longer receive updates from the PHP project.
Which countries have taken government websites offline?
The Netherlands, Denmark, France, Finland, and Canada have taken at least some government websites offline as a preventive measure.
What is the severity of CVE-2026-109618 and CVE-2026-109619?
Both vulnerabilities have severity scores of 9.2 out of 10 and are rated critical by PHP.
