PHP critical CVE sends governments offline before the patch
The upcoming PHP security release (CVE-2026-109618 / -109619) is the day's fire drill. A demo video is circulating on Twitter showing someone pasting something into a URL and getting a shell on the server, and the proof of concept is being shared privately. The thread's first complaint is that nobody has said which versions are affected.
The Dutch National Cyber Security Center took its public site offline, and a commenter notes Finnish state services did the same (linked via yle.fi). Pulling the plug before a patch exists is the only option when exploit details are out and the fix is not.
The joke in the comments is that PHP will publish its patch on a website that runs on something else entirely. The pattern: a long-tail runtime nobody thinks about becomes an emergency the moment a pre-disclosure leak hits Twitter. Defenders are now racing a leaked demo video, not a coordinated release date.
So what?
Inventory what you run, including old marketing sites, admin panels and WordPress installs, before the patch drops. Have a plan to take a service offline or put it behind a WAF within an hour. If your stack touches PHP, assume the exploit is public before the advisory is.