Europe Just Switched Off Its Own Websites. Here’s What PHP2Shell Means for Yours.

Last updated: 22 October 2026. This is a developing story, and I’ll update this post as the facts change.

On Wednesday, 21 October, PHP shipped emergency fixes for two critical flaws. Within hours, public websites across Europe were being switched off on purpose. I’ve built and looked after websites for years, and I’ve not seen anything like this.

PHP2Shell at a glance

What happened

The flaws are now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can let an attacker run commands on a web server without logging in. PHP says updating is the only complete fix, and the patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The release was meant to land on Thursday. Details leaked online on Tuesday, so PHP moved it forward by a day.

Then organisations started pulling the plug:

• Finland: the state IT centre, Valtori, took government public web services offline.
• France: the Interior Ministry took its prefecture websites offline while it waited for the fix.
• Netherlands: national and local government sites went down, including the national cyber security agency’s own site.
• Elsewhere: Reuters reported schools and hospitals doing the same, and sites also came down in Germany, Belgium and the Czech Republic.

Most of these were precautions, not breaches. They followed official advice. The UK’s National Cyber Security Centre told organisations to consider taking a system offline if they couldn’t fix it straight away. CERT-EU, the EU’s cyber response team, advised isolating internet-facing apps until a fix is applied and verified.

Why this one is different

These flaws have been in PHP for more than a decade. Wiz says versions as far back as PHP 5.4 are affected.

They weren’t completely unknown, either. During a 2024 security audit of PHP, a core developer spotted the first signs of the memory problem behind one of them. Nobody could show it was exploitable, the team couldn’t agree on a fix, and the work stalled and restarted for months. The PHP Foundation has been unusually honest about this, calling the delay a structural failure caused by its decision process and lack of resources.

What changed was AI. On 11 August, a researcher at security firm Calif reported a working attack, built with help from an OpenAI model. OpenAI reported the same root cause that day. Wiz found more attack paths independently, using its own AI tool alongside Google and OpenAI models.

Wiz says the hard part used to be making an exploit work across different PHP versions and server setups. AI models removed that barrier. OpenAI called it one of the most impactful security issues in recent memory, and Wiz ranks it among the most severe flaws ever found in PHP.

Behind the scenes, PHP’s maintainers, researchers, Cloudflare and government agencies spent about two months preparing the fix. The final stretch was messy: a researcher accidentally posted a demo video, and one software distributor published patched builds hours before the agreed release.

OpenAI expects findings like this to increase sharply in the coming months. The PHP Foundation says the number of reports it receives will keep growing too.

Is this the next Log4Shell?

Honestly, it’s too early to say. Here’s where things stand.

Attacks have started, but nobody agrees on how well they’re working. Cloudflare reported attack attempts hours before the fix was even out. watchTowr saw attempts hitting its sensors but no successful ones. Huntress found no sign of break-ins on the servers it watches, and CISA said it hadn’t seen exploitation. Patchstack, on the other hand, says it has confirmed several active exploitation incidents. Working proof-of-concept code is now public, so I’d plan on the worst case.

AI-found flaws aren’t automatically more dangerous. Research firm VulnCheck looked at 1,061 flaws found with AI help. Only 14 of them, about 1.3%, have been confirmed as exploited in real attacks. That’s about the same rate as every other flaw.

What makes this one stand out is scale. PHP runs underneath WordPress, Drupal, Joomla, Magento and a huge share of the web. And plenty of sites run old versions. One count of internet-facing servers found that 59% of those showing a PHP version were on branches PHP no longer fixes. Around a third of WordPress sites are in the same position.

If you run a WordPress site, do this today

The flaw sits in PHP, the software underneath WordPress. Updating WordPress, your theme or your plugins won’t fix it.

1. Check your PHP version. In your dashboard, go to Tools, then Site Health, then the Info tab. Open the Server section.
2. Read the number carefully. If you see 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer), you’re on a fixed release. A lower number doesn’t always mean you’re exposed, though. Many hosts, including those running CloudLinux or cPanel, patch PHP without changing the version, and some patched builds even show a lower number (8.4.26 instead of 8.4.27). On 8.1 or older, PHP itself won’t release a fix, so you depend entirely on your host’s patch. Either way, only your host can confirm which build you’re on.
3. Message your host. Ask them to confirm the fix is installed and PHP has been restarted, not just scheduled. A server keeps running the old code until PHP restarts.
4. If you took your site offline, keep it offline until they confirm. A maintenance mode plugin may not be enough. On some server setups, an attack can land before WordPress even loads.
5. Plan your upgrade if you’re on PHP 8.1 or older. Even if your host has patched it, you’re on borrowed time. Test on a staging copy first.
6. Treat firewall rules as a stopgap. Cloudflare has extended its protective rules to every plan, including Free. That buys time, but it isn’t the fix.
7. Once patched, check for signs of a break-in. Look for admin users you don’t recognise and files you didn’t add. Researchers showed the flaw can expose passwords and API keys held in server memory, so consider changing them if anything looks off.

Here’s a message you can send your host:

Message to your hostCopy message

Hi, can you confirm the PHP2Shell fix (CVE-2026-109618 and CVE-2026-109619) is installed on my server and that PHP has been restarted? Please tell me which PHP version and build I’m running. Thanks.

If you’re just using websites

There’s nothing for you to install. The fix is the website owner’s job. If a site you use is down this week, that alone doesn’t mean it’s been breached. If a site confirms an incident, change your password there, and anywhere else you reused it.

PHP2Shell: frequently asked questions

One last thing

Send this to anyone you know who looks after a website. A lot of small business owners are still waiting for their host to tell them something, and in a situation like this, waiting is the risk.

If you’d like a second pair of eyes on your site, drop me a message.

Sources

• PHP security advisory: Critical remote code execution vulnerabilities, update now (php.net)
• Today’s PHP security release and how we’re strengthening PHP security (The PHP Foundation)
• Security Advisory 2026-018 (CERT-EU)
• Critical vulnerabilities in PHP require immediate patching (CISA)
• Factbox: websites taken offline over PHP risks (Reuters, via Global Banking & Finance)
• PHP panic: governments take sites offline (Decrypt)
• Security agencies warn: patch now or take systems offline (ITPro)
• PHP emergency patches for PHP2Shell: who found it and exploitation status (CyberScoop)
• PHP2Shell patches land as first exploitation attempts hit sensors (SecurityWeek)
• OpenAI: AI found one of the biggest web weaknesses ever (Forbes)
• AI-found bugs aren’t proving any easier to exploit (VulnCheck research) (The Register)
• What we know about php2shell: exposure and end-of-life figures (CybelAngel)
• PHP2Shell: Patchstack and Aikido reports (SOCRadar)
• PHP2Shell technical analysis (Sansec)
• Cloudflare deploys protections against php2shell (Cloudflare)

About the author

Chinomso Onu is a web designer and WordPress developer who builds and looks after websites for small businesses, coaches, legal and home-service companies. See Chinomso’s portfolio or get in touch.