Government agencies and organizations worldwide are temporarily shutting down websites following the discovery of two critical vulnerabilities in the PHP programming language. These flaws allow unauthorized remote access to servers, code execution, and data theft. According to Wiz, the vulnerabilities affect approximately 70% of the internet.
The Wikimedia Foundation suspended some online systems on October 22, 2026. Similar actions were taken by government entities in Finland, the Netherlands, France, Germany, and Belgium. Cybersecurity agencies in the US, UK, EU, and Australia issued warnings, while Japanese Prime Minister Sanae Takaichi advised operators to patch systems or take resources offline.
The vulnerabilities were identified by researchers at Calif and Wiz using AI tools, including Google Gemini 4 Argon and OpenAI GPT-5.6 Sol. These flaws had remained undetected for over a decade and received a severity score of 9.2 out of 10. Developers have already released patches for current versions of PHP, which is widely used in CMS platforms like WordPress, Drupal, and Joomla.
In Russia, experts identified approximately 50,000 potentially vulnerable PHP-based applications. BI.ZONE WAF and other security firms are urging organizations to audit their PHP versions and apply updates immediately. Cloudflare has already reported initial attempts to exploit these vulnerabilities in the wild.
