On Wednesday, October 21, 2026, two critical vulnerabilities in PHP — the programming language quietly running a huge share of the internet — set off a global security scramble. The flaws, nicknamed PHP2Shell, can let attackers run code on a server without logging in. By the end of the day, emergency patches were out, cybersecurity agencies in Europe, Australia, Japan and Britain had issued urgent warnings, and government websites across Europe had gone dark as a precaution.
What Happened?
Quick Answer: On October 21, 2026, PHP's developers released emergency fixes for two critical flaws — CVE-2026-109618 and CVE-2026-109619 — rated 9.2 out of 10 in severity. The PHP2Shell vulnerabilities can let attackers run code on unpatched servers without logging in. Government websites across Europe went offline as a precaution, and security researchers reported attacks were already underway.
What Is the PHP2Shell Vulnerability?
The PHP2Shell vulnerability isn't a single bug. It's a pair of critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 on the CVSS v4.0 scale — about as serious as it gets. The danger is unauthenticated remote code execution: an attacker can potentially run their own code on a vulnerable server over the internet, no password required.
PHP's own developers were blunt about where the risk is highest. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," they said. Security firm Wiz Research, which disclosed the flaws, warned hackers could exploit them to execute remote code and access sensitive information stored in memory on affected servers — including passwords, API keys and tokens.
Just about every version of PHP in common use could be exposed. Geo News reported that all PHP versions launched within the last decade from 5.4 are affected, while CERT-EU and Australia's Cyber Security Centre said all versions from PHP 5 onward could be at risk. That reach matters because PHP is everywhere — Huntress put it simply: "It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
The fixes came in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on Wednesday afternoon. A patched version was made available around 1:45 p.m. GMT, according to Geo News.
Websites Pulled Offline Across Europe
Before the patch even landed, the precautionary shutdowns began. In the Netherlands, the websites of the national cybersecurity agency, the Port of Rotterdam, the Dutch government portal and the KNVB football association went down, along with hospital and political party sites, while the Dutch parliament's site and those of the country's cybersecurity authorities and data protection regulator also went dark.
Finland's state IT provider Valtori pulled government services offline, Denmark's Kombit shut down the national school communication platform, and in France the Interior Ministry took down local government administration websites.
The shutdowns followed blunt official guidance. The EU's CERT-EU had issued an advisory on Tuesday warning of unauthenticated remote code execution: "Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available." Australia's Cyber Security Centre issued similar guidance, though it said it was "not aware of active exploitation related to these vulnerabilities."
Others were seeing something different. Cloudflare chief technology officer Dane Knecht reported attacks were already happening and said he was changing firewall rules in the meantime, urging everyone to "patch as soon as PHP releases the update." Jake Knott, head of threat intelligence at watchTowr, said his team was "already observing in-the-wild exploitation" — though none had succeeded yet, and "we don't expect that will last long."
Why It Matters
Most people never think about PHP, but they use it constantly. Every news site, online shop or service built on WordPress probably runs on it — Geo News put PHP's share at roughly 70 to 75 percent of the web. A remotely exploitable hole in software that common is a nightmare scenario: GoDaddy warned the flaws could let attackers execute code on servers over the internet, "potentially leading to data theft, website defacement or full system compromise." And as Huntress researcher John Hammond told The Register: "The number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast."
What Happens Next
The immediate race is patching: every organization running web-facing PHP needs to move to the fixed releases, because the attacks already flagged are expected to grow more capable as exploit code circulates.
Expect a second wave too: incident disclosures. If any organizations were breached before patching — details began circulating a day before the official release — forensic reviews in the coming weeks will determine the true fallout. Cybersecurity agencies in Europe, Australia, Japan and Britain all told organizations to monitor for signs of intrusion, not just to patch.
Key Takeaways
- Two critical PHP flaws, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were patched on Wednesday, October 21, 2026, with a 9.2-out-of-10 severity rating.
- The bugs can allow unauthenticated remote code execution — attackers may be able to run code on vulnerable servers without logging in.
- All PHP versions from 5.4 onward are affected, according to the disclosing security firm; fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Government and public websites across the Netherlands, Finland, Denmark and France went offline as a precaution before and during the patch release.
- Cloudflare and watchTowr reported attacks were already underway, though Australia's Cyber Security Centre said it had no confirmed active exploitation.
- Organizations that can't patch immediately are being told to take affected systems offline — and to monitor for signs of intrusion.
Frequently Asked Questions
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two critical flaws in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619. Rated 9.2 out of 10 in severity, they can allow an attacker to run code on an unpatched web server without needing to log in. Security firm Wiz Research disclosed the flaws, and emergency patches were released on Wednesday, October 21, 2026.
Which PHP versions are affected?
According to the disclosing security firm, all PHP versions launched within the last decade from 5.4 are affected. The EU's CERT-EU and Australia's Cyber Security Centre said all versions from PHP 5 onward could be at risk. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP's developers urged users to upgrade as soon as possible.
Why did government websites go offline?
They went down deliberately, as a precaution. CERT-EU advised organizations that couldn't patch immediately to take affected websites offline, and cybersecurity agencies in Europe, Australia, Japan and Britain echoed the warning. Sites including the Dutch national cybersecurity agency, the Port of Rotterdam, Finland's government services and France's local government administration sites were pulled before or during the patch release.
Has PHP2Shell actually been exploited?
Reports differ. Cloudflare's chief technology officer said attacks were already happening, and watchTowr said it was observing in-the-wild exploitation attempts with "php2shell" markers — though none had succeeded yet. Australia's Cyber Security Centre, however, said it was not aware of active exploitation. Security experts expect real compromises to follow as exploit code spreads.
What should website owners do right now?
Update immediately to a patched PHP release — 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or have your hosting provider do it. CERT-EU says that where patching isn't immediately possible, internet-facing applications should be isolated or taken offline until a fix is applied, and monitored for signs someone already got in.
Does this affect ordinary internet users?
Not directly — the flaw lives in server software, not in browsers or phones. But if attackers compromise websites before they're patched, stolen data could include user information held by those sites. There is nothing users need to patch themselves; the fix sits with website operators and hosting providers.
Related Stories
- Meta $25 Billion Fine: New Mexico Judge Rules in Privacy Case
- OpenAI Expands ChatGPT Ads to 26 More Countries
- Google Cloud Outage: UK Banks and Services Down
Sources
- Reuters — "EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities" (October 21, 2026): reuters.com
- Geo News — "Critical PHP flaw 'PHP2Shell' triggers global website shutdowns as fix goes live" (October 21, 2026): geo.tv
- The Register — "PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched" (October 21, 2026): theregister.com
