On October 21, 2026, a critical vulnerability in PHP, the programming language used to create most websites, was reported. Due to this vulnerability, the Netherlands and Finland have already disabled their government websites and services, as it allows hackers to gain access to their systems.
Risks to Websites
The vulnerability in PHP has been rated with a threat level of 9.2 out of 10, indicating its severity. Hackers can exploit this vulnerability to:
- Execute malicious code on servers;
- Steal data;
- Hack websites.
Millions of websites are at risk, including popular platforms such as WordPress, Drupal, Magento, Joomla, and “1C-Bitrix”.
Actions by Governments and Companies
In response to the threat, the Netherlands and Finland have taken measures to protect their government resources. Specifically, Finland has suspended part of its government services, while the Netherlands has shut down the websites of parliament, government institutions, and hospitals. Additionally, Cloudflare has reported the first attempts of attacks on vulnerable websites and has implemented additional security measures.
Updates and Recommendations
Today, October 21, emergency updates for PHP versions 8.2–8.5 have been released. However, older versions that are no longer supported remain at risk. Cybersecurity experts urge all users to promptly install the updates available on the official PHP website to avoid potential attacks.