PHP2Shell explained: why government websites in 6 European countries went offline

Summary. Two critical flaws in PHP's core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, led governments and other organisations across Europe to take websites offline on 21 October 2026 while they patched. Reuters reported precautionary shutdowns in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic, and Danish and Wikimedia services were also taken down. Both flaws score 9.2 (critical) under CVSS v4.0 and can let an unauthenticated attacker run code on the server as the web worker account. PHP fixed them in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says updating is the only safe choice. A shutdown is not proof of a breach: on 21 October CISA, Germany's BSI, the Dutch NCSC and Canada's Cyber Centre said they had not seen exploitation, and no successful attack had been confirmed by the morning of 22 October. The risk is rising, though. Proof-of-concept material leaked a day before the release, Cloudflare saw attack traffic, and Amazon's threat intelligence team, as cited by Tenable, says the flaws are now broadly exploited. If you run PHP anywhere, patch every runtime, restart it, and check logs.

About this article. This is a news explainer on a fast-moving incident. Facts were checked against PHP's advisory and CVE records, CERT-EU, ENISA, national cyber agencies, government statements, Reuters and the researchers' own posts on 22 October 2026, and the status may have changed since. Researched with AI assistance and reviewed by our editorial team.

Quick facts about PHP2Shell

• Identifiers: CVE-2026-109618 and CVE-2026-109619. PHP titles them remote code execution via out-of-memory corruption and via stale global state; the PHP2Shell name comes from the researchers' exploit script.

• Severity: CVSS v4.0 9.2 (critical) for both, assigned by PHP; NVD adds a CVSS 3.1 score of 9.8.

• Impact: unauthenticated remote code execution as the web worker account; CVE-2026-109619 can also disclose memory.

• Released: 21 October 2026, after the CVE identifiers leaked on 20 October.

• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches have unofficial source backports only.

• Highest risk: Apache with mod_php, where an unauthenticated request can trigger the bug before any application code runs.

Which European countries took websites offline?

The table lists organisations named in reporting and official statements. It does not mean any of these websites was compromised.

The Reuters factbox covers Germany, France, Belgium and Finland, and Reuters' wider report covers the Netherlands and Denmark. The Dutch government's own notice names DigiD and MijnOverheid, Yle carried Valtori's statement, the Belgian cybersecurity centre's position was reported by RTBF, and the Czech timings come from ČTK. The wider German list comes from dpa via heise, and the ANSSI request from the Interior Ministry's notice as reported by Actu17.

Beyond the six. Danish municipal IT company Kombit shut down several services, including the national school communication platform. The Wikimedia Foundation said it had deliberately taken many supporting services offline, including Toolforge and Wikimedia Cloud Services, until they could be patched; that is not the same as Wikipedia being hacked. The Record reported that hundreds of websites were down on 21 October.

What is PHP2Shell?

PHP is the server-side language behind a large share of websites, content management systems and APIs. Many organisations run it without writing PHP themselves, through WordPress, Drupal, Joomla, a hosting stack or a vendor product.

PHP2Shell is two memory-safety flaws in PHP's core runtime (php-src), not a mistake in any one website's code. PHP lists CWE-416 (use after free) among several weaknesses for both:

• CVE-2026-109618: an out-of-memory condition can leave request memory uninitialised, and the cleanup that follows may read or act on it, giving a path to memory corruption.

• CVE-2026-109619: global state can keep pointing at request memory after it has been freed, so a later request handled by the same worker may read that stale state. This one can also expose memory.

CERT-EU says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php highest, because a demonstrated exploit works from an unauthenticated request before any application code runs. Wiz, one of the finders, says it demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla, and released no exploit code.

How far back the flaws go

PHP's advisories list only its supported branches as affected. The longer range comes from the researchers: Wiz says every PHP version released in the last decade is affected by at least one of the two flaws, going back to PHP 5.4, and Calif dates the earliest affected path to PHP 5.4.0. Cloudflare says the same.

PHP 8.1 reached end of life on 31 December 2025, so there is no official 8.1 release. Given the severity, PHP's security team published minimal source backports for PHP 7.4, 8.0 and 8.1 as git branches, not as releases. If you run an older branch, get a patched package from your Linux distribution or long-term support vendor, or move to a supported version. PHP 8.2 itself reaches end of life on 31 December 2026, as our guide to hiring PHP developers explains.

How the PHP2Shell bugs were found

Several teams found the flaws independently over the summer:

• Calif. Researcher Ryan Austin found the first issue on 1 August and reported it on 11 August, as part of OpenAI's Patch the Planet programme, which pairs AI-assisted vulnerability research with human review for open-source maintainers. OpenAI says Calif used GPT-5.6 Sol. Calif's own write-up credits an LLM companion and names no model.

• OpenAI. The PHP Foundation says OpenAI independently reported the same root cause on the same day.

• Wiz. Wiz says it discovered the flaws on 19 August using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported them on 24 August.

• Quarkslab. The PHP Foundation says the first signs of the bug surfaced in a 2024 Quarkslab audit.

PHP's maintainers wrote the fixes, credited to Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka and Nora Dossche. The disclosure did not go to plan. The CVE identifiers leaked on 20 October around 15:00 UTC, and Calif mistakenly published a video of its proof of concept around 20:00 UTC that evening. Cloudflare deployed seven web application firewall rules to every plan, including Free, from 03:02 UTC on 21 October, about nine hours before disclosure.

The AI angle matters, but it cuts both ways. Models helped researchers find bugs in a three-decade-old codebase, and the same tools speed up attackers, as our guide to AI-assisted cyberattacks describes.

Were the government websites hacked?

The shutdowns are not evidence of breaches. Germany said no security incidents were known, Finland's Valtori said its outage was not caused by exploitation or a data breach, and Belgium's cybersecurity centre said it had recorded no attacks on Belgian websites. As of the morning of 22 October, heise reported no confirmed successful attacks.

The threat picture moved quickly, and the advisories reflect the hour they were written:

• 21 October. CISA said it had not observed exploitation as of publication and told organisations unable to update to take PHP-based systems offline. Germany's BSI rated the issue very high, had seen no attacks yet, but expected broad exploitation within hours of the patches. Canada's Cyber Centre said a proof of concept was available but no active exploitation had been identified. CERT-EU said proofs of concept were circulating, which raised the likelihood that attackers were already exploiting the flaws.

• 22 October. New Zealand's NCSC said it was aware of reports of active exploitation. Tenable reported that Amazon's threat intelligence team says php2shell is now being broadly exploited in the wild. Cloudflare said it saw attack traffic after the leak, with attackers mutating payloads.

Neither CVE was in CISA's Known Exploited Vulnerabilities catalogue as of its 21 October update. Treat that as a lag, not reassurance.

Which PHP versions fix the issue?

PHP released these versions on 21 October 2026:

Distribution packages may carry different version numbers with the fix backported, so check your vendor's advisory, not just the version string. Products that bundle PHP need their own updates: the Dutch NCSC keeps a PHP2Shell repository of affected third-party software on GitHub, which by our count listed several hundred products from more than 450 suppliers on the morning of 22 October, with over 200 marked vulnerable and most still under investigation.

What should website owners and developers do now?

If you run a website, API, CMS or server that uses PHP, treat this as an emergency change.

1. Inventory every PHP runtime. Include PHP-FPM pools, Apache with mod_php, containers and images, staging, cron jobs and vendor appliances. The CLI version can differ from the runtime that serves web requests.

1. Install the fixed release or your vendor's patched package. Ask your hosting provider if you do not manage the runtime.

1. Restart or redeploy. Updated packages do nothing until web server and worker processes reload them.

1. Verify on every node. Check the active runtime version through admin tooling, not a public phpinfo() page.

1. Look for signs of compromise. Unusual processes spawned by PHP services, new files or accounts, and unexpected outbound connections around 20 to 22 October. A patch stops future use of the flaw; it does not clean a server that was already entered.

1. Isolate what you cannot patch. CISA, CERT-EU and the EU institutions' joint statement all advise taking exposed systems off the public internet until they are fixed.

1. Check embedded and end-of-life PHP. Use the NCSC-NL list and your vendors' advisories, and plan an upgrade away from unsupported branches.

PHP's advisory is blunt: "There are no complete mitigations, updating is the only safe choice." Its interim measures, which CERT-EU says do not make an installation safe, include an administratively set memory_limit of -1 backed by a container or cgroup memory cap (never RLIMIT_AS or RLIMIT_DATA), a low post_max_size, front-end limits on request size, fields and multipart parts, blocking multipart requests if unused, disabling upload progress, fatal_error_backtraces off on PHP 8.5, and recycling PHP-FPM workers after every request where performance allows. On a PHP-FPM pool, that looks like this:

            ; Interim measures from PHP's 21 October 2026 advisory.
; They reduce exposure but do not replace updating PHP.
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_flag[session.upload_progress.enabled] = off
; Only where performance allows:
pm.max_requests = 1
          

Pair the unlimited memory_limit with a container or cgroup memory limit, and remove it once you have updated. If you sit behind Cloudflare, its managed rules give some cover, but a web application firewall is a stopgap too. For a repeatable approach to emergency runtime patches, see our Node.js security release playbook; the same steps apply here.

If you sell a product with digital elements in the EU that bundles PHP, check whether the Cyber Resilience Act's reporting duties apply, as our CRA vulnerability reporting explainer describes.

Why precautionary shutdowns can be the right call

Taking a public service offline is disruptive, but when a flaw allows unauthenticated remote code execution and a patch is hours away or cannot be applied at once, isolation can be the safer choice. The joint statement from the European Commission, ENISA, CERT-EU, Europol's EC3 and the EU CSIRTs network advised patching urgently and, where that is not feasible, isolating exposed applications from public networks.

The shutdowns also exposed a gap: many organisations do not know where PHP runs underneath their websites, from legacy portals to vendor appliances. Knowing that inventory, who owns each runtime, and how fast a fix can be verified decides how long a site stays dark. WordPress estates are a common case, which is why our WordPress development team treats runtime patching as part of routine maintenance.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our PHP development team can inventory and patch PHP runtimes across servers, containers and CMS estates, plan upgrades off end-of-life branches, and work with our cybersecurity services team on log review after an exposure window. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Security advisory: critical remote code execution vulnerabilities, update now — PHP

1. Factbox: websites taken offline over PHP risks — Reuters via Investing.com

1. CVE-2026-109618 detail — NIST National Vulnerability Database

1. php2shell: updates arrive, many websites offline, attacks under way — heise online

1. PHP2Shell frequently asked questions — Tenable

1. Today's PHP security release and how we're strengthening PHP security — The PHP Foundation

1. Government websites go dark as software flaw sparks security scramble — Reuters via CNBC

1. Aantal websites Rijksoverheid preventief offline na kwetsbaarheden PHP — Rijksoverheid

1. Valtori shuts down state web services over PHP vulnerabilities — Yle

1. Une faille informatique mondiale: un correctif publié pour PHP — RTBF

1. NÚKIB doporučil webům s PHP aktualizaci, Úřad vlády odstavil web — ČeskéNoviny.cz (ČTK)

1. Failles critiques dans PHP: des sites coupés en urgence, dont ceux des préfectures — Actu17

1. Impact of PHP vulnerabilities on Wikimedia tools and services — Wikimedia Foundation, Diff

1. Hundreds of websites taken offline as concern grows over two PHP vulnerabilities — The Record

1. CVE-2026-109619 detail — NIST National Vulnerability Database

1. Security Advisory 2026-018: critical vulnerabilities in PHP — CERT-EU

1. PHP2Shell: AI uncovers critical RCE vulnerabilities — Wiz

1. Cloudflare deploys protections against php2shell vulnerability — Cloudflare

1. php2shell — Calif Research

1. Patch the Planet: global response coordination as agents uncover critical vulnerabilities — OpenAI

1. Critical vulnerabilities in PHP require immediate patching — CISA

1. PHP: kritische Schwachstellen bedrohen Webanwendungen weltweit — BSI

1. AL26-026: critical vulnerabilities impacting PHP — Canadian Centre for Cyber Security

1. CVE-2026-109618 and CVE-2026-109619 affecting PHP — New Zealand NCSC

1. php2shell operational information — NCSC-NL on GitHub

1. Joint statement on critical PHP vulnerabilities — ENISA