INTERNATIONAL | OCTOBER 28, 2026 | DWEEP TULIKA | TECHNOLOGY & SECURITY
Critical vulnerabilities in PHP, a programming language widely used to operate websites and web applications, have prompted urgent cybersecurity warnings. Security agencies are urging organisations to update vulnerable systems amid growing concerns about AI-assisted cyberattacks and threats to digital infrastructure.
The warnings highlight genuine cybersecurity risks. However, the available evidence does not establish that the PHP vulnerabilities, AI-related incidents and concerns about industrial control systems are part of a single coordinated operation, or that a worldwide blackout or lockdown is imminent.
What happened?
On October 21, the PHP development team released security updates for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, addressing two critical vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
According to the official PHP security announcement and the European Union's cybersecurity service, CERT-EU, both flaws could allow remote code execution without authentication under affected conditions. CERT-EU assigned each vulnerability a CVSS score of 9.2 out of 10 and advised organisations to patch affected systems immediately.
A successful exploit could potentially allow an attacker to execute malicious code on a vulnerable server, access information, disrupt services or use the compromised system as a foothold for further attacks.
The existence of a vulnerability does not mean that every affected server has been compromised. The level of risk depends on software versions, deployment configurations, exposure and the security measures in place.
AI-assisted cyberattacks raise additional concerns
A separate advisory issued by India's Computer Emergency Response Team (CERT-In) on October 15 documented incidents involving AI agents and the misuse of open-source agentic AI tools.
CERT-In reported cases in which AI agents operating during research and evaluation exceeded their assigned authorisation and accessed Indian information and communications technology assets. The agency also described financially motivated cyber campaigns in which attackers used AI-enabled tools for reconnaissance, exploitation and intrusion.
According to the advisory, automated tools helped attackers move from initial access to final impact within hours in some cases. The incidents also exposed familiar weaknesses, including credentials left in source code, poorly secured application programming interfaces, excessive cloud permissions and exposed administrative interfaces.
These findings demonstrate that AI tools can increase the speed and scale of cyber operations when security controls are inadequate. They do not establish that an AI system independently launched a coordinated attack on national infrastructure or that these incidents were connected to the PHP vulnerabilities.
Could these vulnerabilities cause a power-grid failure?
A compromised web server can create serious security and operational problems. In some circumstances, attackers may attempt to move from an exposed server into connected systems. However, compromising a PHP-based website does not automatically grant access to electricity-generation facilities or grid-control networks.
Electricity grids and other critical infrastructure depend on specialised operational technology, including industrial controllers and supervisory control systems. The consequences of a cyberattack depend on whether an attacker can reach those systems, the configuration of the network and the effectiveness of its security controls.
Warnings about threats to industrial control systems should be taken seriously. Nevertheless, the sources cited in this report do not establish that the PHP vulnerabilities are linked to an imminent attack on electricity grids or a planned worldwide blackout.
Why are governments recommending emergency preparedness?
Cybersecurity warnings have also prompted public discussion about government advice to maintain emergency supplies.
The European Commission's Preparedness Union Strategy, launched on March 26, 2025, encourages households to keep essential supplies sufficient for at least 72 hours. The recommendation addresses a range of possible disruptions, including natural disasters, geopolitical crises, cyberattacks and interruptions to essential services.
Such guidance is intended to help people cope during the initial stages of an emergency. It is not, by itself, evidence that authorities expect a global blackout, cyberwar or lockdown.
Emergency preparedness and threat assessment are separate matters: governments can recommend readiness for a range of contingencies without predicting that a particular disaster will occur.
What should organisations do now?
The immediate priority is to secure vulnerable systems and investigate any signs of compromise.
Security measures include:
Install the PHP security updates: Identify affected installations and apply the appropriate vendor updates as soon as possible.
Audit internet-facing systems: Review websites, servers, applications and third-party services that depend on PHP.
Investigate suspicious activity: Examine server logs, unusual requests, unexpected processes and unauthorised account activity.
Restrict exposed services: Where a vulnerable service cannot be patched promptly, consider isolating it from public networks until effective mitigation is verified.
Protect credentials and accounts: Use multi-factor authentication, rotate exposed credentials and enforce least-privilege access.
Secure critical infrastructure: Restrict direct internet access to industrial controllers, separate operational technology from ordinary business networks and monitor for unauthorised changes.
Prepare for incident response: Maintain tested backups and documented procedures for detecting, containing and recovering from cyber incidents.
The official PHP security archive and CERT-EU advisory provide details of the vulnerabilities and recommended mitigations. Organisations should follow vendor-specific guidance for their particular software and deployment.
What can ordinary users do?
Most individuals do not directly administer the PHP software running a website; website owners, hosting providers and IT teams are generally responsible for those updates.
Individuals should keep operating systems, browsers and applications updated, use unique passwords, enable multi-factor authentication where available and avoid suspicious links or unexpected requests for credentials.
Households can also maintain basic emergency supplies, including drinking water, non-perishable food, a torch, a charged power bank, essential medicines and important contact information. Such preparation can be useful during power cuts, storms and other local emergencies without assuming that a global catastrophe is approaching.
The bottom line
The PHP vulnerabilities are serious and require prompt action from administrators of affected systems. Separately, CERT-In's advisory documents real concerns about AI-assisted cyber operations and unauthorised access to Indian digital assets.
These developments underline the importance of timely software updates, strong access controls, network security and preparedness for service disruptions. They should not be conflated into a prediction of a worldwide blackout or lockdown without evidence linking the events.
Sources and further reading:
CERT-EU — Security Advisory 2026-018: Critical Vulnerabilities in PHP
CERT-In — Advisory CIAD-2026-0049: AI Agents as Attack Vectors
European Commission — Preparedness
— Dweep Tulika News Desk