PHP underpins large parts of the internet and the vulnerabilities have raised concerns that a significant number of websites could be vulnerable to serious cyber attacks.
"PHP is everywhere," cybersecurity company Huntress said in a blog post.
"It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
The European Union Computer Emergency Response Team and Australian Cyber Security Centre issued warnings about the risk.
Governments to react with precautionary website and internet services shutdowns included Germany, Finland and Belgium.
The Netherlands took several websites of its public health institution RIVM offline as did French prefectures, while the White House was assessing potential impacts.
Developers said a set of new updates fixing two previously identified vulnerabilities were now live and strongly encouraged users to update immediately.
The updates were for a number of different versions of PHP.
