Millions of Websites Could Be at Risk as Critical Security Flaws Trigger Urgent Warning

Widely used PHP installations face critical flaws, with no evidence that millions of websites have been compromised

Hacking — Two critical PHP security flaws have prompted urgent warnings over potential risks to millions of websites worldwide Tibe De Kort/Pexels

Millions of websites could face serious cybersecurity risks after researchers identified two critical vulnerabilities in PHP, a programming language widely used to operate online services.

The flaws prompted emergency security updates on Wednesday, 21 October 2026, with cybersecurity specialists urging organisations to examine their systems and address potentially dangerous weaknesses.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each received a severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system.

Why Millions of Websites Could Be Vulnerable

PHP operates behind many websites, processing information, communicating with databases, and supporting online applications. It is widely used by content management systems including WordPress, Drupal and Joomla, making vulnerabilities in the software particularly concerning for website administrators.

According to Google Cloud's security analysis, the newly disclosed flaws could potentially allow attackers to execute malicious code remotely without authentication. Successful exploitation could also expose sensitive information stored in server memory.

Depending on how an affected website is configured, these weaknesses could threaten confidential information, website operations and connected systems. However, the discovery does not establish that millions of websites have been compromised or that users' personal information has been stolen.

Actual exposure depends on factors including the PHP version installed, system configuration, and whether security updates have been applied.

Emergency Updates Released Following Security Warnings

The PHP development team released patched versions on 21 October 2026 to address the vulnerabilities. These included PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Google Cloud advised organisations to update affected PHP installations and ensure their applications use the corrected software.

Cloudflare also confirmed that it had deployed web application firewall protections before the vulnerabilities were publicly disclosed.

Such protections can help reduce exposure to malicious requests, but they should not be treated as substitutes for installing the appropriate software updates.

The Canadian Centre for Cyber Security issued an advisory concerning the vulnerabilities, highlighting the importance of addressing affected systems.

Its assessment did not identify active exploitation at the time of publication. Separately, Palo Alto Networks' Unit 42 reported seeing proof-of-concept exploits for the vulnerabilities.

These statements reflect the respective organisations' observations and do not necessarily describe the same monitoring period.

What Website Owners and Internet Users Should Know

For organisations operating websites, the immediate priority is identifying whether their servers use affected PHP versions.

Administrators should review the official security advisories, install applicable updates, and check whether their hosting providers have already implemented fixes. Websites running unsupported software may require additional attention because older installations do not necessarily receive routine security maintenance.

Organisations should also examine relevant security logs for unusual activity and investigate suspicious requests where appropriate. Updating an individual website plugin does not necessarily resolve vulnerabilities in the underlying PHP installation.

For ordinary internet users, the situation is different. Visitors generally cannot repair vulnerabilities in websites operated by businesses, public authorities or other organisations.

Maintaining strong passwords, enabling multifactor authentication and remaining cautious about suspicious messages are sensible precautions, although these measures do not directly fix server-side flaws. The vulnerabilities illustrate how weaknesses in widely used software can potentially affect numerous unrelated online services.

Although emergency patches have been released, organisations that continue operating vulnerable installations could remain exposed until appropriate protections are applied.