The Official Fix: Turn It Off.

When two critical vulnerabilities surfaced in PHP this week — CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 and allowing attackers to take over servers without a password — the official guidance from cyber agencies in the UK, the US and the EU was refreshingly simple. Patch it now. And where patching right now isn't feasible, the UK's National Cyber Security Centre advised, consider taking the system offline until it can be fixed.

Governments took the advice personally. The Netherlands' National Cyber Security Centre pulled its own website offline, alongside the Port of Rotterdam, the national government portal, the Dutch football association and several hospitals. Finland's state IT provider took government public services down as a precaution. France's Interior Ministry put its sites into preventive maintenance, Denmark shut down services, Edinburgh Council and several BBC programme pages went dark, and Wikipedia took an unspecified number of its systems offline until they could be patched.

Emergency patches landed on Wednesday, October 21, covering PHP 8.2 and newer — which still leaves a long tail of older sites waiting on fixes while the official recommendation hangs over them.

It is the most honest tech support the internet has ever received: the people in charge of defending it reached the same conclusion as everyone who has ever owned a router. When in doubt, turn it off.

The underlying reporting is filed in the Evidence Locker: Computer Weekly (Oct. 21, 2026).