Two CVEs in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. Under default configuration, an unauthenticated external request can trigger a low-level exception through specific parameters and reach code execution on the server.

The operational response was blunt. Government sites across several European countries went offline around the same time. In the Netherlands the digital identity system and personal government portals were shut down in an emergency. Major platforms in Japan posted maintenance notices one after another, and customers ordering sushi were told the mobile mini-program was paused for a system upgrade. A cabinet official posted late at night urging everyone responsible for ops to respond immediately, adding that pulling the network cable and taking a site offline was still a necessary way to reduce risk when a patch could not land in time.

Around the same days, two other stories were circulating.…