Emergency PHP Patches Trigger Website Shutdowns Across Europe and Beyond

PHP developers released emergency security updates on October 21 after the discovery of two critical vulnerabilities collectively called PHP2Shell. The flaws could let an attacker without an account run code on a web server, according to The Hacker News.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The Cloudflare Blog said they affect all web servers running PHP 5.4 or later and identified Calif.io, Wiz, OpenAI and Quarkslab as the organisations that disclosed them.

The potential reach is unusually broad. CNET News Tech reported that up to 70% of websites could be affected. That is an estimate of potential exposure, not a count of websites successfully attacked.

Details about the flaws leaked online on October 20, a day before the emergency updates, according to Mashable Tech. TechRadar reported that the premature disclosure prompted an early security advisory and an urgent upgrade warning.

On October 21, PHP issued fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, The Hacker News reported. Its coverage also described emerging exploit attempts, adding urgency to the patching effort.

European cybersecurity officials warned that organisations unable to apply the fixes should consider taking their websites down, according to Sky News. Germany's Federal Office for Information Security described the risk as extraordinarily high, DIE ZEIT reported.

Precautionary shutdowns followed across Europe. The Guardian reported that Belgian, Dutch, Finnish, French and German websites were among those taken offline. CBC Top Stories also reported Canadian government websites going offline.

By later coverage on October 21, Dutch websites were gradually returning. nu.nl reported that government, municipal and hospital websites were coming back online after being taken down as a precaution.

Patches are available, but the immediate task remains getting them installed. Deutsche Welle reported that PHP developers were urging immediate updates, while The Cloudflare Blog announced that it had deployed protections against PHP2Shell.

The reported outages should not automatically be read as evidence of successful attacks. Le Monde described websites being placed into maintenance following the emergency fixes, and Telegraaf reported precautionary shutdowns. Separately, The Hacker News reported exploit attempts, making the distinction between preventive disruption and actual compromise important.

The next practical measure is how quickly operators apply the updates and restore services taken offline. Dutch sites have begun returning, according to nu.nl, but the supplied coverage does not establish how many websites remain unavailable or how many have been compromised.

There is also a question about the repair process before this week's emergency. The Next Web reported that the PHP Foundation said it had identified one of the flaws in 2024 but spent months unable to agree on a fix. That account raises a separate issue from today's patch rollout: why a known vulnerability remained unresolved.