PHP Security Flaws Force Website Shutdowns as Global Patching Effort Continues

Two critical vulnerabilities in PHP, a programming language used across much of the web, have sent website operators racing to secure their systems. The flaws are collectively called PHP2Shell, according to Le Monde.

The potential consequences go beyond an unavailable webpage. Business Line - Home reported an NSA warning that attackers could use the flaws to take control of web servers, steal data, disrupt services or move through networks.

AI tools helped researchers discover the vulnerabilities, according to Bloomberg Technology. PHP's widespread use turned that discovery into an urgent problem for governments, businesses and website operators around the world.

Accounts differ on the precise announcement date. Fanpage places it on October 20, while Zoho Blog says the PHP Foundation announced security releases for the two flaws on October 21. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

On October 21, government websites across Europe went offline while operators worked to fix the vulnerabilities, according to CNN Brasil. These shutdowns were precautionary measures, not in themselves evidence that attackers had broken into the sites.

By October 22, the disruption included 32 UK government services offline and another four partially unavailable, The Register reported. Singapore organisations were also being urged to fix both flaws immediately, according to South China Morning Post, while Times of India reported that CERT-In had flagged the vulnerabilities.

The threat was already active before the public response. On October 22, SiliconANGLE reported Amazon's finding that attackers had begun targeting the flaws four days before patches were released. Exploit attempts observed by Cloudflare had since reached the millions.

The ability to apply those patches was uneven. Telegraaf reported on October 22 that half a million Dutch websites could not carry out the crucial PHP update, highlighting the difficulty facing smaller businesses.

The scale of attempted exploitation does not yet establish widespread successful intrusion. NBC News reported on October 22 that experts had seen few, if any, reports of widespread damage from hackers exploiting the flaws. That sits alongside Amazon's warning, reported by Ars Technica Tech, that the vulnerabilities were being broadly exploited, leaving the extent of successful compromise unclear.

There were also signs of recovery. Deutschlandfunk - Fortlaufende Nachrichten vom 24. August 2026 reported that many websites were back online and that there were no current indications Germany's federal websites and IT systems had been compromised.

On October 23, CBC Top Stories explained that websites had been taken offline to implement fixes. For readers encountering an unavailable service, the outage may therefore reflect defensive maintenance rather than a confirmed breach.

The immediate test is whether operators can secure systems that cannot simply accept a current patch. DEV Community says PHP 8.1 and older branches will receive no official fix, leaving operators to upgrade or ask hosting and distribution vendors about backported patches.

The other unresolved issue is how many attempted attacks actually succeeded. The contrast between rising attempts and limited reports of widespread damage makes evidence of confirmed compromises more useful than attack counts alone.