Governments from Helsinki to The Hague pulled their own websites offline this week — not because an attack succeeded, but because of a flaw in PHP, the programming language behind a large share of the web. Going dark was a precaution while administrators rushed to install an emergency patch.
On October 21, the PHP project released fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under CVSS version 4.0. Either flaw can let an attacker run code on a web server without logging in. The pair is known as the PHP2Shell vulnerability.
Two ways in, neither needing a login
The first flaw, CVE-2026-109618, involves memory handling. When PHP runs out of memory in the middle of a request, it can stop with internal request data only partly built, and cleanup code then treats that broken data as valid. An attacker who controls its contents can steer it toward running a command.
The second, CVE-2026-109619, involves state that outlives its memory. A PHP worker handles many requests over its life. If internal state tied to one request survives after its memory is freed, a later request on the same worker can follow the stale pointer. The PHP advisory confirms command execution through this path on both Apache with mod_php and PHP-FPM.
What makes the flaws hard to defend against at the application level is timing. On Apache with mod_php, a demonstrated exploit triggers before any application code runs, so a login wall or plugin cannot intervene in a request that never reaches them. PHP says every installation serving web requests is at risk, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, with mod_php at the highest risk.
A leak forced the patch out early
PHP had planned to publish the fixes on October 22. Details leaked online on October 20, before coordinated disclosure, and the project pulled the release forward to October 21 at 14:00 UTC.
Cloudflare chief executive Matthew Prince said attack attempts climbed from thousands in the ten hours before the announcement to millions within hours of it, according to Reuters. Amazon said it had seen widespread exploitation, and Datadog Security Labs reports that Amazon honeypots logged an exploitation attempt as early as October 17, four days before disclosure.
The Netherlands took DigiD, MijnOverheid, and Overheid.nl offline, and Finland’s public sites went dark. Denmark shut sites including Copenhagen Municipality, the Danish Road Directorate, and the Aula school platform. Germany, Belgium, France, and Canada took sites down as well.
The Dutch National Cyber Security Centre said on Thursday that several sites had returned online and that it had no evidence the vulnerabilities had been successfully exploited. The shutdowns were precautionary: no source has confirmed that a government site taken offline was compromised.
The patch, and the follow-up
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive updates from the project, though it supplied minimal source backports for versions 7.4, 8.0, and 8.1 for people who build from source or lack a long-term-support vendor.
Updating WordPress or its plugins does not fix this: the server’s PHP itself has to move to a fixed version.
Temporary settings can narrow exposure — session.upload_progress.enabled=0, for example — but PHP is blunt that these steps do not make an installation safe. Only updating does.
On October 23, PHP added a follow-up advisory: keep session.upload_progress.enabled=0 until the next regular bugfix release to cover an unlikely related vector, which needs an unusual combination — an application that switches its session serialize handler at runtime before session_start(). A full advisory for CVE-2026-115560 arrives with the next release.
Why this one landed so hard
PHP powers about 7 in 10 websites with an identifiable server-side language, according to commonly cited figures. A flaw in its core therefore touches an unusually wide surface, from government portals to small business sites whose owners may not know what version their host runs.
The discovery points to a shift in how flaws surface: Wiz Research is credited with finding the bugs, and OpenAI says its models helped. The underlying code had sat in PHP for more than a decade. Microsoft chief executive Satya Nadella, speaking at an event in Germany, said he had “not seen anything like this in a long, long time,” Reuters reported.
Attackers are increasingly using AI tooling of their own, as in the case of AI agents used to breach thousands of companies through ConnectWise. The defense, in both cases, starts with the same step: know what version you run, and update it.
For site owners, the checklist from the PHP advisory is short. Confirm the PHP version serving web traffic. Install the fixed release. Then check again: a container image or bundled interpreter can quietly keep the old version alive.
