PHP2Shell flaw forces government websites offline worldwide
Two critical PHP flaws dubbed PHP2Shell forced governments in Europe and Japan to take websites offline as emergency patches landed; CISA urged immediate patching or going offline.
Critical PHP vulnerabilities dubbed “PHP2Shell” forced government agencies across Europe and Japan to take websites offline on Wednesday, 21 October, as the PHP project rushed out emergency patches.
The two flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and allow remote code execution, according to Geo News. Wiz Research, which disclosed them, said attackers could exploit the bugs to run code remotely and access sensitive information stored in memory, including passwords, API keys and tokens. All PHP versions from 5.4 are affected, according to Geo News.
Before the fix landed at around 13:45 UTC, Dutch authorities took the National Cyber Security Centre, the Port of Rotterdam, Overheid.nl, the KNVB, hospital sites and political party websites offline. Finland’s Valtori pulled government network services offline, Denmark’s Kombit shut the national school communication platform, and France’s Interior Ministry placed websites into preventive maintenance. In Japan, the Codmon childcare app stopped all services, Studio suspended its dashboard and editor, and Sakura Internet halted some functions, per Reuters and Japan Cyber Watch.
CISA issued an urgent alert, “Critical Vulnerabilities in PHP Require Immediate Patching”, urging updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — and telling organisations unable to patch to take PHP-based systems offline. It said it had not observed exploitation as of publication.
Cloudflare CTO Dane Knecht said early attacks were already appearing and the firm was updating firewall rules as a stopgap: “patch as soon as PHP releases the update.” Australia’s cyber security centre said it was not aware of active exploitation, per Rappler.
More on this topic: all Technology stories
