AI-assisted research has helped uncover two severe PHP vulnerabilities that forced government websites and other digital services across Europe and beyond to temporarily go offline.
PHP developers released urgent security updates on October 21, 2026, after technology companies detected attempts to exploit the flaws. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, received a CVSS severity score of 9.2.
The flaws can allow remote code execution without a login or expose information in server memory, potentially enabling attackers to steal data, alter website content or take control of affected systems. The vulnerabilities reportedly existed in the codebase for years.
Government and public-service websites temporarily suspended operations in countries including the Netherlands, Finland, France and Denmark. Wikipedia and the Internet Archive also paused some systems while applying security updates.
According to Wiz, researchers used its Wiz Atlas platform alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol models to analyze the PHP codebase and verify the vulnerabilities. Amazon also reported detecting an exploitation attempt against a honeypot on October 17, before the public disclosure.
Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website operators were urged to update immediately, or suspend vulnerable services if patches cannot be installed.
Source: EntArabi
-p-2000.png "SEQUENCIVE and KAUST Launch namya to Advance Sustainable Agriculture in Saudi Arabia")
