Websites down worldwide: PHP security flaws could cause outages lasting weeks

Due to two critical security vulnerabilities, governments, local authorities, universities and large corporations have taken parts of their websites offline worldwide in recent days. The flaws were found in PHP, the programming language that, according to W3Techs data, powers nearly 70 percent of the world's websites, including WordPress, Wikipedia and Slack. The vulnerabilities, dubbed "PHP2Shell" by researchers and tracked as CVE-2026-109618 and CVE-2026-109619, were classified by PHP's developers in the most severe category possible, each receiving a score of 9.2 on a scale of ten.

According to The Hacker News, the flaws lie in PHP's engine, meaning a website can be vulnerable even if its own code is flawless, and they affect almost every version of PHP starting from 5.4. In the most dangerous scenario, involving the widely used Apache mod_php module, a single unauthenticated request can be enough for an attacker to run their own code on the server ahead of the website's own program, effectively taking full control of it. Even without executing code, attackers can also peer into the server's memory, from which other users' passwords, login tokens, programming keys and certificates can leak out.

PHP's security team issued an urgent warning on Tuesday evening, asking users to prepare for an update. The patches were released on Wednesday, October 21, ahead of the originally planned Thursday date, after details leaked prematurely and one of the discoverers accidentally published a video demonstrating the exploit. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older are no longer supported by the developers, and only source-level fixes exist for them. According to The Record, roughly half of the sites running PHP are on such outdated versions. CERT-EU, which protects European Union institutions, already advised on Tuesday that anyone unable to update their systems quickly should consider taking their websites offline, or at least disconnecting them from the public internet until a fix is ready. Germany's BSI, the British and Dutch national cybersecurity centers, as well as the Japanese and Australian authorities, also issued warnings, while the U.S. National Security Agency (NSA) warned that the flaw could open a direct path for attackers to a server's file system and databases. The UK's cybersecurity center also asked organizations to check, after updating, whether attackers had left a backdoor in their systems.

In Belgium, the Netherlands, Finland, France and Germany, governments temporarily took some of their websites offline. In the United Kingdom, the websites of the Edinburgh, Bristol and Oxford city councils went down, and in France several local municipal websites, including that of the Paris police prefecture, became unavailable on Wednesday. In the Netherlands, the national digital identity service, the website of the lower house of parliament, and the national cybersecurity center's site were also affected, while in Australia the website of the signals intelligence agency was temporarily affected as well. The Wikimedia Foundation shut down several of its systems as a precaution, and according to The Record, Nintendo, Berlin's Charité hospital and the open-source video project OBS also suspended some of their services. The University of Freiburg's computing center also reported taking exceptional measures .

The flaws were discovered and reported by the American cybersecurity firm Wiz, the Calif research group, and OpenAI's Codex Security team, who worked together with PHP's security team and Google's Gemini team on the fix. According to Calif, they found the flaws on August 1 with the help of a large language model, while Wiz used its own analysis tool together with Google's and OpenAI's latest AI models. According to the researchers, the flaw had been lurking in PHP's code for more than a decade, with some of its roots going back even further. The first signs of one of the vulnerabilities were already detected in PHP's 2024 external security audit, but at the time no one found a way to exploit it. Artificial intelligence, however, is a double-edged sword. According to Joviane Jardim, an expert at Detectify, most attackers today can build a working exploit tool within an hour of a patch being released, so a wave of attacks can be expected almost immediately after updates are published. "No one has succeeded so far, but we don't think that will remain the case for long," Jake Knott of the cybersecurity firm watchTowr told The Record. By Wednesday afternoon, the company had already detected active attack attempts against both flaws, some carried out using AI-generated tools. According to Dane Knecht, Cloudflare's chief technology officer, attackers are already experimenting with bypassing the company's firewall rules. According to G4Media, Amazon's security chief, CJ Moses, also said that the company had already detected an attack attempt from an anonymous IP address against one of its decoy systems on October 17, four days before the flaws were disclosed. There are no confirmed reports of a successful breach so far.

According to experts, the danger will not disappear with the patches. Costin Raiu, a researcher at the cybersecurity firm TLP:Black, expects mass hacking of vulnerable web servers, while security expert Michał Woźniak says the compromised servers could be used to mine cryptocurrency or be employed by state actors and organized crime groups for distributed denial-of-service (DDoS) attacks. Alan Woodward, a professor at the University of Surrey, warned that many websites are not maintained by anyone, so they could remain vulnerable for weeks or even months, meaning continuous attacks should be expected for weeks or months to come. Companies and institutions using PHP therefore not only need to update, but also check whether attackers have left any trace in their systems. For anyone responsible for their own website, the most important thing to do right now is to check which version of PHP is running on their server, and if it is not one of the patched versions, to update immediately or seek help from their hosting provider.

Ugar