Member-only story
The PHP Bug That Made Governments Pull Their Sites
Two memory bugs. A 9.2 severity score. An attack that can run before your application code. Here's what broke, and how to fix it.
On October 21, 2026, parts of the internet went offline on purpose.
Not an outage. Not a confirmed breach. Governments in the Netherlands, Germany, France, and Finland pulled public websites as a precaution while engineers raced to install an emergency PHP patch.
CISA urged immediate patching and told organizations that could not patch right away, or that still run unsupported PHP 8.1 or older, to take PHP-based systems offline until they could be patched.
NSA Cybersecurity, October 21: if an immediate update is not feasible, organizations should take the system offline until it can be fully mitigated.
The cause was two bugs in PHP itself, the runtime behind roughly 70% of the websites that use a server-side language. Both scored 9.2 on CVSS v4.0. Both allowed unauthenticated remote…
