Two critical PHP vulnerabilities trigger global website shutdowns as security agencies urge immediate updates to prevent remote attacks

New Delhi: Websites across several countries went offline on 21 October 2026 after security researchers uncovered two critical flaws in PHP, a programming language used by millions of websites. Government portals in Finland, the Netherlands, France, the UK, Australia and Japan faced disruptions, along with Wikipedia systems, BBC programme pages, Dutch hospitals and the Port of Rotterdam. Website operators took these services offline or restricted access to prevent attackers from exploiting the flaws to gain control of their servers.

The shutdowns did not happen because a massive cyberattack had already taken over these systems. Instead, organisations took preventive action to protect their websites from two serious security flaws in PHP, the programming language that powers a large part of the internet.

Cybersecurity agencies, including the US National Security Agency (NSA), CERT-EU, the UK’s National Cyber Security Centre (NCSC) and other agencies across Europe and Asia, issued similar warnings. They advised organisations to install security updates immediately or take vulnerable websites offline. The PHP Foundation released emergency updates on the same day. Researchers have named the incident PHP2Shell.

What Is PHP, and Why Does It Matter So Much?

PHP originally stood for Personal Home Page. Today, it stands for PHP: Hypertext Preprocessor. Developers created this open-source programming language in the mid-1990s to build websites and applications that run on web servers.

PHP powers WordPress, which runs more than 40% of all websites, along with Drupal, Joomla, Magento, MediaWiki (the software behind Wikipedia), Laravel, Symfony and countless custom applications. Industry trackers estimate that PHP powers around 70–75% of websites that use an identifiable server-side programming language. This means hundreds of millions of websites, from small blogs to national government portals, depend on it.

PHP handles many of the processes that allow websites to respond to visitors’ requests. A security flaw in the language itself can therefore expose millions of servers to the same type of attack.

The Two Critical Flaws: CVE-2026-109618 and CVE-2026-109619

Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10, placing them among the most serious security flaws. They allow attackers to run their own code on vulnerable servers without logging in. Attackers can trigger the flaws by sending specially designed HTTP requests to affected systems.

Security researchers found the bugs in core parts of PHP that handle memory and errors. The flaws involve the session.upload_progress feature, which PHP enables by default.

One vulnerability involves a use-after-free error. This happens when a program continues to use a piece of memory after it has released that memory for other purposes. An attacker can trigger this condition by causing an out-of-memory situation. The second vulnerability allows outdated global data to remain in place across worker processes.

Together, these flaws can allow remote code execution (RCE), which means an attacker can run malicious code on a server from another computer. In some cases, attackers may also be able to expose information stored in the server’s memory, creating a risk similar to the older Heartbleed vulnerability.

Researchers have identified Apache’s mod_php configuration as one of the highest-risk setups. In this configuration, an attacker may trigger the flaw before the website’s application code even starts running. PHP-FPM, CGI and other Server Application Programming Interfaces (SAPIs) also face risks.

The vulnerabilities have reportedly existed in some form since PHP 5.4, which dates back to around 2012. They affect every later version up to the releases that received fixes on 21 October 2026. However, the PHP project issued official fixes only for actively supported versions.

How AI Helped Discover These Serious Security Flaws

Two research groups independently discovered the vulnerabilities with the help of advanced artificial intelligence models.

Ryan Austin, from cybersecurity firm Calif, reported the first flaw on 11 August 2026 while working under OpenAI’s “Patch the Planet” programme. GPT-5.6 Sol helped the team identify the issue. Alphabet-owned cybersecurity firm Wiz later discovered a second related flaw on 24 August. Its researchers used large language models, including Gemini and GPT variants, alongside their own security tools.

Wiz described the findings as ranking “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” OpenAI also called the discovery one of the most impactful security issues in recent memory.

The incident has drawn attention to the growing role of advanced AI in cybersecurity. These models can help researchers find hidden weaknesses in software, but attackers can also use similar tools to discover flaws and develop ways to exploit them.

One detail makes the discovery particularly interesting. An external security audit of PHP had identified one of the underlying out-of-memory conditions in 2024. However, developers could not agree on a safe solution that would preserve compatibility and performance. As a result, they did not prioritise the issue at that time.

The Leak That Forced an Emergency Response

The PHP project originally planned to disclose the vulnerabilities on 22 October. However, details of the flaws and a demonstration video of an exploit tool called PHP2Shell began circulating on online forums and social media on 20 October.

The video showed the tool successfully running code on systems using WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, Symfony and other popular platforms.

The leak forced PHP maintainers to bring forward the release schedule. They also issued an advance warning to alert users and administrators.

Cloudflare reported thousands of attempts to exploit the vulnerabilities in the hours before the public announcement. The number reportedly rose to millions within hours of the disclosure. Amazon had also detected probing activity several days earlier.

Multiple cybersecurity firms confirmed active exploitation of the vulnerabilities in real-world attacks on the day the PHP project released its emergency fixes.

Who Went Offline, and Why?

Organisations faced a serious risk: attackers could potentially take control of vulnerable servers without needing login credentials. Many organisations therefore chose to disconnect their systems temporarily rather than leave them exposed.

Several countries and organisations reported shutdowns or service disruptions:

• Finland: The state IT provider Valtori shut down public government web services to reduce the risk of attacks.
• The Netherlands: The National Cyber Security Centre took its website offline and moved information to GitHub. The Port of Rotterdam, parliamentary websites, hospitals and DigiD identity services also faced disruptions.
• France: The Interior Ministry placed prefecture websites and other online services into preventive maintenance.
• The United Kingdom: Edinburgh Council and several BBC pages, including popular programme websites, went offline. The Office for Budget Responsibility also took protective action.
• Wikimedia Foundation: The organisation took multiple systems offline.
• Australia, Japan and Denmark: Australia’s cyber agency and the Australian Bureau of Statistics (ABS), Japanese hosting providers and Danish school platforms reported outages or suspended services.

The NSA issued a particularly direct warning. It advised organisations that could not update their systems immediately to prepare to take those systems offline. CERT-EU and national computer emergency response teams issued similar guidance.

These actions showed how seriously organisations viewed the risk. Temporary shutdowns disrupted public access to information and services, but they also reduced the chance that attackers could exploit the vulnerabilities while administrators prepared security updates.

The Emergency Fixes

On 21 October 2026, the PHP project released four updated versions to address the vulnerabilities:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

According to the reported security advisory, these are the official patched versions that website operators should install.

PHP 8.1 and older versions have reached the end of their support period. The main PHP project no longer provides security fixes for these versions, although some Linux distributions and commercial support providers may offer their own updates.

Website owners and system administrators must install the appropriate update and restart PHP workers, including PHP-FPM and Apache processes, where necessary. Some researchers have suggested temporary measures, such as disabling session.upload_progress.enabled. However, these measures do not fully protect systems against the vulnerabilities. Installing the official security update provides the complete fix.

Website owners should also understand that WordPress automatic updates do not update the underlying PHP runtime. Hosting companies and system administrators must update that software separately.

What Ordinary Internet Users Need to Know

Most people who browse the internet do not need to install anything on their phones or computers because of this incident. Website owners, developers and hosting companies must handle the security updates.

However, people who run personal websites, small-business WordPress blogs or other PHP-based applications should contact their hosting providers immediately. They should confirm that the provider has installed one of the four patched PHP releases.

Until administrators confirm that they have secured their systems, they should treat vulnerable websites as potentially compromised. They should check for signs of tampering, including changed website content, unexpected administrator accounts and possible data leaks.

Website owners should also review server logs, investigate suspicious activity and check whether attackers accessed sensitive information before the updates became available.

The Long-Term Problem: Millions of Websites May Remain Vulnerable

Installing emergency updates will not protect every website. Many operators still use outdated PHP versions that no longer receive official security fixes.

Cisco Talos estimated that roughly half of all internet-facing PHP instances run unsupported versions. These systems may never receive an official fix from the main PHP project, although some third-party providers may supply security updates.

BuiltWith and other scanning services estimate that PHP powers tens of millions of websites. Many of these sites have outdated software, lack regular maintenance or no longer have active administrators.

Security experts warn that these neglected systems could remain vulnerable for months or even years. Attackers can use automated tools to scan the internet, identify unpatched servers and attempt to exploit them repeatedly.

This creates a long-term security problem even after major organisations install the emergency updates. Attackers often target older websites because their owners may lack the technical knowledge, money or staff needed to maintain them.

Broader Implications of the PHP2Shell Incident

The PHP2Shell crisis highlights three major issues affecting modern cybersecurity.

First, AI is speeding up vulnerability discovery and exploit development. Researchers can use advanced AI models to identify software weaknesses more quickly. However, attackers may also use these models to find flaws and develop malicious tools. This makes rapid detection, responsible disclosure and timely patching even more important.

Second, the internet still depends on old and widely used software. PHP has powered websites for decades, and millions of organisations continue to rely on it. A single serious flaw in a technology used by an estimated 70% of websites can therefore disrupt services around the world.

Third, coordinated security disclosures depend on keeping information confidential until organisations can prepare. Researchers and software developers often coordinate announcements so administrators have time to install updates before attackers learn the technical details. In this case, the reported leak exposed the issue earlier than planned and forced maintainers to respond urgently.

The incident also showed that governments and large organisations are willing to accept temporary service disruptions to protect their systems. Smaller businesses and website operators may find that decision harder because they have fewer resources and depend on their websites for daily operations.

What Happens Next?

Website owners and hosting providers must continue installing the updates and checking their systems for signs of compromise. Many high-profile websites that went offline reportedly returned within hours or a day after administrators applied security measures.

Cybersecurity teams continue to monitor attacks and investigate possible exploitation. Security firms are also releasing detection rules and additional protective measures to help administrators identify suspicious activity.

The PHP Foundation has stressed that users running supported versions must install the updates without delay.

For website owners and developers, the incident reinforces three basic security practices: keep software updated, replace components that no longer receive security support, and treat updates to core programming languages and frameworks as seriously as operating-system security patches.

The PHP2Shell crisis of October 2026 was not the first incident to force organisations to take emergency action to protect the internet, and it will not be the last. However, the reported combination of severe vulnerabilities, widespread exposure, AI-assisted discovery and rapid activity by both defenders and attackers made this incident particularly significant.

For anyone who runs a website, the immediate priority is clear: check the PHP version, confirm whether it contains the security fixes and install the appropriate update. Website owners should also investigate possible signs of compromise rather than assume that patching alone has resolved every risk.