Security

Governments pulled their websites offline over PHP2Shell. Here's how to protect yours.

A critical PHP flaw sent sites offline worldwide. What happened, who was hit, and a simple fix any website owner can follow today, plus steps for developers.

By TorGit team · October 21, 2026 · 8 min read

On October 21, 2026, government portals, hospitals, universities and household names switched their websites off on purpose. The reason: a flaw in PHP, the software behind most of the world's websites. Here's what happened, and the simple steps that keep your site safe.

The short version

What: two critical PHP flaws, nicknamed PHP2Shell, let attackers take over a website's server without a password.
Who: any site running PHP that hasn't been updated yet. That includes most WordPress and WooCommerce websites.
The fix: PHP has to be updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. If you don't manage your own server, send your web host the message in this article today.

Last updated: October 21, 2026. We're updating this page as the story develops. Sources are listed at the bottom.

What happened: the 48 hours that shook the web

October 20: details of two serious PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leak online before a fix exists. A short video of an attack briefly appears and is taken down. Security firms confirm the flaws are real.
October 20 to 21: cyber agencies in the European Union and the UK tell organizations that can't patch in time to consider taking their websites offline. Agencies in Germany, Japan, Australia, the Netherlands and the US issue warnings too.
October 21, during the day: websites start going dark as a precaution, from national government portals to well-known brands.
October 21, 14:00 UTC: the PHP team releases fixed versions and urges everyone to update immediately.
Same day: Cloudflare and the security firm watchTowr report that attacks have started appearing.

Who went offline

The biggest impact was in Europe, where governments followed the advice to pull sites offline until they could patch:

Netherlands: the national government portal Overheid.nl, the website of the national cyber security center (NCSC), the Port of Rotterdam's public website, the national football association (KNVB), several hospital websites and the sites of the country's five largest political parties.
Finland: Valtori, the state IT provider, took government public network services offline.
Denmark: the municipal IT company Kombit shut several services, including the national school communication platform.
France: the Interior Ministry temporarily took local government websites offline.
Germany: the University of Freiburg switched off its central websites, intranet, learning platform and student webmail.
Worldwide: Nintendo took some services offline, and so did parts of Wikipedia, Pinboard and the forums 4chan and Something Awful. In Japan, some daycare and video game systems went offline too.

Why this is such a big deal

Imagine finding out that the most popular brand of door lock in the world can be opened without a key. That's roughly what PHP2Shell is for websites.

PHP is the software that runs behind the scenes on roughly 69% of websites whose server technology is known, including WordPress, the platform behind a huge share of small business sites. The two flaws are rated 9.2 out of 10 for severity. An attacker doesn't need a password or an account: a specially crafted visit to the website can be enough to run their own commands on the server. From there they could steal data, change your site, or use it to attack others.

Security researchers estimated that well over a million internet-facing servers could be vulnerable. That's why organizations chose to switch their websites off for a few hours rather than take the risk.

Is your website affected? The 30-second check

If your website is...	Then...
WordPress or WooCommerce (you log in at `yoursite.com/wp-admin`)	Very likely affected until PHP is updated. Follow the steps below.
Drupal, Joomla, Magento or a custom PHP or Laravel site	Affected until PHP is updated. Follow the steps below and share the developer section.
On a hosted builder (for example Shopify, Wix or Squarespace)	You can't update their servers yourself. The platform handles it. Check their status page or announcements.
A static or serverless site with no PHP at all	Not affected. Just make sure no old plugin, admin panel or tool you run still uses PHP.

How to fix it, no tech skills needed

Find out who looks after your website's server. Usually your hosting company, your web designer or your agency. Updating PHP is a server job: it doesn't happen when you update WordPress or plugins.
Don't count on automatic updates. The security company Wordfence warned that automatic updates won't apply this fix.
Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server and look for "PHP version". In cPanel, look for Select PHP Version or MultiPHP Manager.
Compare it. You're safe on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a newer release in the same series). If you see 8.1, 8.0, 7.x or older, it's urgent: those versions no longer get official fixes.
Send your host or developer the message below and ask for a written confirmation.
Keep an eye out for anything odd: admin users you didn't create, strange new pages, spam links, or warnings from your host.

Copy and paste this to your web host or developer

Hi, I've read about the critical PHP vulnerabilities called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Could you confirm today that the server running [your website] is on a patched PHP version (8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer), and that PHP has been restarted after the update? If we're on PHP 8.1 or older, what's the plan to upgrade? Thanks.

Hand this part to your developer

The PHP core team has been clear that patching is the only real fix. A PHP release manager put it bluntly: "ini settings won't save you."

What's vulnerable

CVE-2026-109618: a flaw in out-of-memory handling while request data is set up. Partially initialized data is later treated as valid during cleanup, opening a path to code execution. PHP says full RCE was validated over HTTP against mod_php with default input and memory limits.
CVE-2026-109619: request-specific state survives after its memory is freed. If the same worker handles a later request, PHP can touch that stale state first: a use-after-free leading to memory disclosure and code execution as the web worker.
Affected setups: per PHP, every installation serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. One exploit path runs before any application code, so your framework can't block it.

Steps

Inventory every PHP install, including staging, old admin tools, control panels, vendor appliances and Windows software bundling php.exe or php-cgi.exe.
Check versions with php -v and php-fpm -v. The CLI and FPM versions can differ.
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Distributions and LTS vendors received fixes early, so check vendor packages. Remi repository users should check availability, since updated packages weren't ready at release time.
Restart PHP-FPM, Apache or your PHP service. Running workers keep the old code in memory.
End-of-life PHP (8.1 and older): PHP published minimal source backports for 7.4, 8.0 and 8.1. Otherwise isolate those systems from the internet or put them behind a VPN until upgraded.
Treat a WAF as a stopgap only. Cloudflare added rules for known exploit paths for all customers but called them "a STOPGAP only," and they only cover traffic routed through Cloudflare.

Signs of compromise

PHP worker processes (php-fpm, php-cgi, httpd, apache2) starting shells, interpreters or download tools.
Reverse-shell patterns such as /dev/tcp/, fsockopen or mkfifo, and whoami, id or uname -a run by the web user.
New files in the web root, new cron jobs or scheduled tasks, and new user accounts.

If you suspect a compromise, isolate the server, keep the web and PHP logs, and look for webshells before bringing it back online.

Careful with "exploit code". Code claiming to exploit PHP2Shell is circulating, and researchers warn that some of it contains malware. Don't run it on anything you care about.

The bigger story: AI is speeding up both sides

According to reporting on the disclosure, the flaws were found by researchers at the security firm Calif using OpenAI's tools, through a program that gives security teams access to AI models. AI is getting very good at finding bugs hidden in old, complex code. That's good news for defenders, but the same tools help attackers turn a leak into a working attack faster.

Three lessons for any business, whatever its website runs on:

Know what you run. The organizations that struggled most were often the ones that didn't know where PHP was installed.
Patch faster. Expect less time between "a flaw is announced" and "it's being exploited".
Limit the damage. Separate systems, minimal access and a quick way to switch a service off make any future flaw far less painful.

The same rules apply to the AI tools businesses are adding now. We cover them in 10 mistakes to avoid before implementing AI agents in your small business.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They let an attacker run code on a web server without logging in. PHP rated both 9.2 out of 10 and released fixes on October 21, 2026.

Why did websites go offline because of PHP2Shell?

Details leaked before a fix was ready, and European and UK cyber agencies advised organizations that couldn't patch in time to consider taking sites offline. Many government, university and hospital websites did so as a precaution until they could update PHP.

Is my WordPress site affected by PHP2Shell?

If your WordPress site runs on a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 in its series, assume yes until PHP is updated. Check under Tools, Site Health, Info, Server in your WordPress dashboard, and ask your host to confirm.

Will WordPress automatic updates fix PHP2Shell?

No. WordPress updates its own code and plugins, not the PHP version on the server. PHP has to be updated by whoever manages your hosting.

Does Cloudflare protect my site from PHP2Shell?

Cloudflare added firewall rules for known attack paths, but describes them as a stopgap only, and they only help if your traffic goes through Cloudflare. You still need to update PHP.

How do I know if my site has been hacked?

Look for new admin users, unfamiliar files, spam pages, new scheduled tasks or warnings from your host. If in doubt, ask your host or developer to check the server and logs before assuming everything is fine.