Reports of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, prompted government agencies, online platforms and other organizations to temporarily take websites offline or restrict services while applying security updates.
The flaws, collectively known as PHP2Shell, could allow attackers to execute code remotely on vulnerable servers without authentication. PHP released security fixes on October 21, 2026.
PHP is used by roughly 69% of websites whose server-side programming language can be identified, according to W3Techs, making the vulnerabilities a concern for a wide range of organizations.
The UK’s National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) issued urgent advisories. The NSA recommended taking affected systems offline if immediate updates were not feasible. The NCSC advised organizations to consider temporary shutdowns if they could not apply temporary mitigations promptly.
The following websites and services were reported to have been taken offline, restricted or placed under emergency maintenance during the response. These measures do not necessarily indicate a successful cyberattack, and some services have since resumed.
Government and public portals
Government agencies were among the organizations that took websites offline as a precaution.
- Netherlands: Overheid.nl and the Dutch NCSC website were taken offline as precautions. Dutch reporting also identified disruptions affecting the Tweede Kamer, the lower house of parliament, and the National Institute for Public Health and the Environment (RIVM).
- Finland: State IT provider Valtori temporarily shut down government public web services as a precaution.
- Belgium: The Foreign Ministry temporarily took its websites offline.
- France: The Interior Ministry temporarily took prefecture websites offline.
- Germany: Federal IT service provider ITZBund took several websites offline.
- Czech Republic: The government temporarily disabled its website to implement security patches.
- Australia: Government websites, including cyber.gov.au, experienced outages while authorities worked to address the vulnerabilities.
Online platforms and forums
- Wikimedia supporting services: The Wikimedia Foundation took supporting systems offline, including Wikimedia Cloud Services and Phabricator, while working to secure them. Wikipedia users also reported access problems, although access was not disrupted for everyone.
- 4chan: The imageboard reportedly switched to read-only mode while awaiting the PHP security update.
- Something Awful: The forum temporarily went offline while awaiting a patch, according to reporting that cited its maintenance notice.
- Fur Affinity: The art community announced a precautionary shutdown until it could apply the security patch.
- Miraheze and Pinboard: Both platforms were reported to have temporarily suspended access in response to the PHP vulnerabilities.
Infrastructure, sport and media
- Port of Rotterdam: The port’s website was temporarily taken offline.
- KNVB: The Royal Dutch Football Association’s website was also taken offline as a precaution.
- The Journal: The Irish news outlet confirmed that its website was temporarily offline while it strengthened its defenses. Its newsroom and mobile apps continued operating.
Online games and entertainment
Cygames titles including Granblue Fantasy, Umamusume: Pretty Derby and Princess Connect! Re announced emergency maintenance linked to the PHP vulnerabilities.
Pokémon Support separately confirmed emergency maintenance for Pokémon Sleep and Pokémon HOME, although the notice reviewed did not identify PHP as the cause.
Disruptions were also reported at Duolingo and GOG, but their connection to the PHP incident was not confirmed in the reporting reviewed.
Security updates released
PHP’s official security advisory urged users to update immediately. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The PHP team warned that temporary mitigations reduce exposure to specific attack paths but do not provide a complete fix. Website operators should apply the appropriate PHP update or contact their hosting provider to confirm that their systems have been patched.
