Critical PHP Vulnerability Forces Worldwide Web Page Shutdowns

A severe security vulnerability affecting the widely used programming language PHP caused widespread internet disruptions on Wednesday, October 21, 2026. Numerous government agencies, municipalities, universities, clinics, and businesses proactively shut down their websites and digital services to protect their infrastructure against potential remote attacks.

The issue stems from two critical vulnerabilities known as PHP2Shell, tracked under the identifiers CVE-2026-109618 and CVE-2026-109619. According to developers, these flaws can under certain conditions allow malicious actors to execute remote code on vulnerable servers without authentication, potentially granting attackers complete control over servers or stored data.

The German Federal Office for Information Security, known as the BSI, classified the threat as critical, noting that the potential scale of the issue is substantial because PHP serves as the backbone for a massive portion of the internet. Systems running popular platforms such as WordPress, TYPO3, Drupal, and Joomla, alongside online shops and custom web applications, could be affected, although not every site using these systems is automatically at risk.

The disruptions impacted public administration portals and public services in various regions, including temporary outages for municipal websites, ministries, police departments, and hospitals. Institutions in multiple states and countries, such as city portals in Mainz and Osnabrück, universities like Freiburg and Basel, and European administration branches, deactivated their online services as a preventative measure.

In several regions, local officials emphasized that the proactive shutdowns were purely protective and did not indicate that their networks had already fallen victim to successful cyberattacks. Rendsburg Mayor Janet Sönnichsen stated that no damages had been detected thus far, noting that while internal networks remained operational, external services were taken offline. Similarly, Ingo Sander, district administrator for Rendsburg-Eckernförde, reported no signs of illegal access while mobile work capabilities were temporarily disrupted for staff.

The technical disruptions also affected regional infrastructure, courts, domain registries, and medical facilities, causing temporary suspensions of online forms and application systems. In some instances, everyday services such as user logins or digital housing benefit applications faced restricted availability while IT service providers evaluated and secured their networks.

PHP developers released security updates on Wednesday afternoon with versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to patch the critical flaws. System administrators and website operators were urgently advised to install the updated versions immediately, while operators relying on hosting providers temporarily took systems offline until patches could be applied.

For ordinary internet users, officials noted there is no immediate action required on personal devices because the vulnerability resides on the server side. However, users were advised to expect temporary outages across various official portals and online services while operators complete security checks and updates.