Cybersecurity officials warned that all websites built with the widely used PHP language should install the newest security patch without delay, according to a report by Anna Washenko on October 21, 2026.
The PHP Foundation announced a security update that addresses two severe vulnerabilities, prompting a number of government portals across Europe and Canada to be taken down as a precaution. Reuters said that authorities in the Netherlands, Denmark, France and Finland removed at least some of their online services while they assess the risk.
In Canada, Minister of Artificial Intelligence and Digital Innovation Evan Solomon posted on X that the temporary shutdown was necessary and urged any site that runs PHP to apply the patch as soon as possible.
PHP is a server‑side scripting language that powers popular content management systems such as WordPress and Drupal. Earlier in the day, cybersecurity firms disclosed that the software had harbored major weaknesses for years, a fact that was only uncovered through the use of artificial‑intelligence tools. Exploiting the flaws could allow attackers to gain control of affected systems.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, interim CEO of the Drupal Association. “This issue impacts the majority of the Internet.”
In the United States, the Cybersecurity and Infrastructure Security Agency issued a bulletin urging organizations to install the PHP Foundation’s new patch. The White House told Reuters it became aware of the problem on Friday.