Cybersecurity news · 21 October 2026
Two critical PHP vulnerabilities have prompted precautionary shutdowns of public services across Europe. Authorities in the Netherlands, Paris and Finland have announced protective measures. PHP released security updates on 21 October, and website operators should now confirm that their hosting environments are patched.
Remote code execution without signing in
The PHP security advisory identifies CVE-2026-109618 and CVE-2026-109619 as vulnerabilities that can allow unauthenticated remote code execution. Both carry a CVSS v4.0 score of 9.2. They concern out-of-memory handling and stale global state respectively. The affected component is the PHP runtime, so updating a website plugin alone does not complete remediation.
CERT-EU advisory 2026-018 says installations serving web requests require assessment, including PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP and LiteSpeed. Operators should check the underlying hosting stack even if they do not use a particular content management system.
Public services taken offline as a precaution
- The Netherlands: a government notice confirms precautionary shutdowns including Overheid.nl, MijnOverheid.nl and DigiD.
- Paris, France: the city government placed some PHP-based sites into maintenance following ANSSI advice, allowing checks and necessary remediation.
- Finland: Traficom temporarily suspended Oma asiointi and Seutuplus.fi for security reasons. Public transport and ticket sales continued operating.
These announcements describe preventive measures; they do not establish that the services were compromised. Availability and restoration should be checked against each authority’s latest notice.
Security updates are available
PHP released the following fixes for its supported branches. Operators should install the listed version or a later security release in the same branch.
| PHP branch | Fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older branches have reached end of life upstream. The absence of a routine release does not establish that an old installation is safe. Organisations using older environments or distribution packages should confirm vendor backports and plan a move to a supported branch.
Priorities for Hong Kong website operators
- Inventory the actual environment: ask the hosting provider or technical team whether public sites, administration tools or embedded third-party products use PHP, and obtain patch confirmation.
- Back up and update promptly: install the upstream or vendor security package, restart the relevant services as required, and verify the runtime actually serving web traffic.
- Check essential workflows: verify sign-in, forms, uploads and payments; retain and review unusual request and error records.
- Restrict exposure if patching is delayed: CERT-EU recommends considering isolation of internet-facing applications until fixes are applied and verified. PHP says temporary mitigations reduce particular attack paths; only an update fully fixes the vulnerabilities.
The priority is to establish that the serving PHP environment is patched, with a clear record of its version and the checks completed.