By early afternoon on 21 October 2026, the Dutch government’s cyber-security agency had taken its own website offline. Its notice said the site was offline temporarily, as a precaution, because of the vulnerabilities in PHP. This was the agency publishing the Dutch advice on those vulnerabilities, and PHP had not yet published a fix. That day and the next, governments and organisations from Canada to Japan did the same.
PHP is the program on a web server that puts a page together before it reaches your browser. By W3Techs’ measure, it runs about seven of every ten websites whose server-side language can be identified. The flaw sat in the part of PHP that lays each request out in memory. When a request ran out of memory part-way, PHP stopped abruptly, and the cleanup step that followed could treat the half-built data as complete. A second, related flaw let one request’s leftover memory reach a later request on the same worker. One fix closed both.
The PHP Foundation says a developer it had contracted found the first signs of the problem in 2024, and wrote that “the delay was a structural failure”. In August 2026, researchers working with AI tools proved the flaw could be used to run their own code on a server. As of 23 October, no authority had confirmed that any named organisation had been broken into through these flaws.
The video follows how the flaw works, why so many sites switched off, what the fix changes, and where the disagreements still stand.
