EU and Canadian Government Sites Taken Offline After PHP Vulnerability Disclosure

Government Sites Go Offline

Government websites in the Netherlands, Denmark, France and Finland were taken offline as a preventive measure after the PHP Foundation announced a security release addressing two critical vulnerabilities. Reuters reported that the four governments took down at least some websites as a preventive measure.

In Canada, Minister of Artificial Intelligence and Digital Innovation Evan Solomon posted on X about the decision to temporarily take government sites offline. Solomon also seconded the call for any website operators using PHP to apply the update as soon as possible.

Scope of the Vulnerability

PHP is a programming language used by major web publishing services including WordPress and Drupal. The vulnerabilities had existed for years and were only recently uncovered through AI tools used by cybersecurity firms. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and affect all PHP installations serving web requests, going back to PHP 5, released in July 2004. Only PHP 8.2 and newer still receive patches.

According to Tiffany Farriss, interim CEO of the Drupal Association, all servers running any version of PHP released in the last 20 years are vulnerable. Farriss said the issue affects the majority of the Internet.

The flaws could allow a hacker to infiltrate a system running PHP and potentially take control of it. The PHP Foundation said there are no complete mitigations and that updating is the only safe choice.

Official Responses

The main US government response was a message from the Cybersecurity and Infrastructure Security Agency encouraging organizations to update to the new patch from the PHP Foundation. In a statement to Reuters, the White House said it was made aware of the issue on Friday.

Earlier coverage: PHP2Shell patches are out: what is at risk and how to protect PHP sites

Sources: Engadget · Wired