|
Getting your Trinity Audio player ready...
|
Around 100 websites in Lithuania have been identified as vulnerable to a critical flaw in PHP, the programming language that runs most of the web, the country’s cybersecurity chief said on Thursday. Antanas Aleknavičius, head of Lithuania’s National Cyber Security Centre, told M1 radio that the affected sites include those run by private businesses and state institutions, and that the centre is still scanning to establish the full extent. PHP is used by an estimated 80 to 90 percent of websites in Lithuania, according to LRT, which reported his comments, so the true number of exposed sites could be higher.
The Lithuanian alert is one part of a worldwide scramble. The PHP developers announced on Tuesday, October 20, and published emergency updates on Wednesday for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, urging all users to update immediately, according to Cybersecurity Dive. Both flaws could allow an attacker to run malicious code on a website and potentially take control of it. The Lithuanian centre issued its own warning on Wednesday, following the international reports. Cloudflare explained the nature of the problem in general terms: the flaws involve how PHP handles errors while processing web requests, and by manipulating data in invalid memory, an attacker may be able to crash a PHP process, expose sensitive information or execute code of the attacker’s choosing.
Aleknavičius laid out the practical consequences. Failing to fix the flaw could leave websites and their servers exposed to attacks, potentially disrupting information systems, he said. The work needed varies: some sites will need only a software update, while others could require more extensive reconstruction, particularly if they run older or heavily customised systems. His assessment of the threat was measured. Tools to exploit the vulnerability are being developed, he said, but there was no evidence they had been used in Lithuania so far. He also warned of a separate critical vulnerability in Java, another widely used programming language, announced by Oracle.
Globally, the picture is more urgent. Fortune reported that Cloudflare said the vulnerability was being broadly exploited in the wild by October 21, and that it saw tens of thousands of exploit attempts within 45 minutes of news of the flaw spreading. Cloudflare also said it had seen some attempts in the days before the official disclosure, raising the possibility that information leaked to hackers beforehand. Not every report agrees on the speed. The PHP Foundation said its security team inspected proof-of-concept code circulating after the leak and found no functional exploit at the time of release, according to Euronews, and it cautioned that taking websites offline does not necessarily mean they have been hacked. Those statements reflect fast-moving facts that were changing within hours.
The scale of exposure is hard to pin down. Because of differences in how websites are set up, not every PHP site is vulnerable, Cybersecurity Dive noted, and estimates vary widely: one researcher put the number of vulnerable websites at more than 1.3 million, while Palo Alto Networks estimated more than 22.6 million exposed instances. PHP underpins about 70 percent of the world’s websites, according to one report, which helps explain why the disclosure caused such a reaction. Governments were among those that acted quickly. Agencies in the Netherlands and Finland took sites offline ahead of the fix as a precaution, CNBC reported, and Euronews said sites from the Dutch parliament to a Pokémon sleep tracker went dark worldwide to stay ahead of attackers.
How the flaws were found is a story in itself. Euronews reported that AI models uncovered two critical security flaws that had been hidden in PHP for more than a decade, with OpenAI describing the bugs as among the most impactful in recent memory. The PHP Foundation said its own developers first noticed signs of the problem in 2024, during an external audit, according to the same report. That timeline matters: it suggests the issues were known in outline long before they were fixed, and that AI-assisted analysis helped turn a vague suspicion into a concrete vulnerability. The same capability can serve attackers, which is why security experts are racing to patch before AI-powered hackers do, as Fortune put it.
Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Euronews. Website owners should check which version their server runs and move to the corresponding fixed release. For many sites, especially those on shared hosting or managed platforms, the hosting provider controls the PHP version, so the first step is to ask the provider whether it has applied the update. Automattic, the company behind WordPress.com, said it was working with the PHP security team to ensure a smooth update, CNBC reported, and owners of WordPress and other content management systems should apply updates through their hosts rather than waiting. Sites that cannot be patched immediately should consider limiting public access until they can be, which is the step some governments took. This article does not describe how the flaws can be exploited, and site owners should avoid downloading unofficial tools that claim to test for them, since those can themselves be malicious.
The risks go beyond defacement. Michał Woźniak, an internet infrastructure expert quoted in coverage of the global attempts, said criminal groups, state-sponsored hackers or crypto miners might nest themselves in exposed sites and then use those resources for their own aims. A compromised website has access to computing power, servers and internet addresses, and an attacker who gains control can steal data, host malware, send spam or use the machine to attack others. For businesses, that can mean customer data exposure and regulatory trouble. For governments, it can mean disruption to public services. For Lithuania, a country that has been the target of cyber operations linked to regional tensions, the stakes are heightened, though the reports reviewed do not link this flaw to any specific actor.
What should readers watch for next? The Lithuanian centre’s scans will show how many sites remain vulnerable and whether any have been compromised. The PHP Foundation and security firms will publish further advisories, and the number of exploit attempts is likely to keep rising as attackers scan the internet for unpatched systems, as experts warned. Organisations should also monitor their servers for unusual activity and review logs, since a site that was exposed before the patch may have been probed. The PHP project publishes security announcements and downloads on the PHP website, and LRT has the Lithuanian report in its coverage of the vulnerable sites.
Readers who follow global technology, cybersecurity and business stories can find more coverage at BusinessTech Nigeria. The lesson from Lithuania’s 100 sites is that a flaw in software used by most of the internet does not stay local: every organisation that runs PHP, from a small business site to a ministry portal, has the same job this week, which is to find out what it is running and update it.
