European and UK websites taken offline after critical PHP vulnerabilities discovered

CERT‑EU and UK cyber chiefs warned organisations to apply emergency PHP patches or pull sites offline after AI‑found flaws allowing remote code execution.

By Felo News Desk · Published Thu, 22 Oct 2026 10:04:50 GMT

On Wednesday 22 October 2026, government and public‑sector websites across Europe and the United Kingdom were taken offline as operators rushed to apply emergency patches for two critical PHP vulnerabilities, according to Reuters, Digital Journal and the Standard.

What happened

Both vulnerabilities, rated 9.2 on the CVSS severity scale, permit unauthenticated remote code execution, enabling attackers to run commands, steal data or fully compromise vulnerable servers. The European Union’s cybersecurity team CERT‑EU advised organisations that could not patch immediately to suspend affected sites, noting that standard automatic updates would not resolve the issue. In the UK, the Office for Budget Responsibility and several local authorities, including Oxford City Council and the City of Edinburgh Council, removed their websites after receiving similar guidance.

What the reports add

Reuters reported that the flaws were uncovered by artificial‑intelligence models built by security firm Calif with OpenAI and Alphabet‑owned Wiz, describing the discovery as “at the edge of human research capabilities.” Digital Journal added that the PHP Foundation issued an advisory on Wednesday urging all users to update immediately, quoting the foundation’s message: “If you run PHP, it is imperative that you update now.” The Standard noted that the incident partially disabled the Finnish government’s official website and affected pages for certain BBC programmes, highlighting the breadth of services impacted.

What was said

“If you run PHP, it is imperative that you update now,” the PHP Foundation told tech departments, as reported by Digital Journal.
CERT‑EU warned organisations to take affected websites offline if patches could not be applied immediately, according to Reuters.
The Office for Budget Responsibility said it had followed guidance to take its website offline, “in view of the critical security issues affecting PHP,” per the Standard.

How it came about

Felo News previously covered the release of emergency PHP patches on 21 October 2026 (PHP team releases emergency patches for critical code‑execution flaws) and the announcement of the critical vulnerabilities (PHP maintainers warn of critical patches for severe vulnerabilities). Those articles detailed the CVE identifiers (CVE‑2026‑109618 and CVE‑2026‑109619) and the recommendation for immediate preparation. The current takedowns are a direct response to those advisories, as organisations act on the guidance issued by CERT‑EU and UK cyber authorities.

Key facts

Two critical PHP vulnerabilities rated 9.2 CVSS were discovered on 22 Oct 2026. (independent.co.uk)
CERT‑EU advised organisations to take affected sites offline if patches could not be applied immediately. (independent.co.uk)
The PHP Foundation urged all users to update immediately on Wednesday. (digitaljournal.com)
UK bodies including the Office for Budget Responsibility and local councils removed their websites following the advice. (standard.co.uk)