Many leading websites worldwide become inactive due to a PHP issue

Due to two critical security vulnerabilities identified in the PHP programming language, which is the foundation of the internet, authorities today (October 21) took steps to disable numerous government and prominent websites in many countries worldwide as a precautionary measure. These vulnerabilities, named "PHP2Shell", are marked with an extremely high risk value of 9.2 on the CVSS index, and allow attackers to remotely gain control (Remote Code Execution) of server computers without any password or login authorization.

PHP is the server-side language on which the functionality of several leading systems worldwide, including WordPress, Drupal, Joomla, Magento, MediaWiki, and Laravel, depends. It is estimated that approximately 70% of websites that have publicly disclosed their server-side language, and over 40% of all websites through WordPress alone, could be affected by this vulnerability.

These two vulnerabilities, named CVE-2026-109618 and CVE-2026-109619, are memory-safety issues within the PHP engine. One involves memory corruption due to an Out-Of-Memory (OOM) condition during request handling, while the other relates to stale internal state remaining even after memory is freed. Affecting the default session upload progress and related paths, this vulnerability impacts almost all active PHP versions from 5.4 (originating roughly in the 2012\/2004 era) up to 8.5.11. In some systems, this attack can be executed even before the website's core code runs, with maximum risk present when using Apache mod_php. Additionally, it directly impacts configurations like PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

In response to this crisis, leading security agencies worldwide, including the UK's NCSC, the EU's CERT-EU, Australia's ACSC, and the US's NSA, immediately issued advisories urging organizations to promptly update their systems or, if unable to do so, to remove them from the internet and disable them.

Following this warning, government and public institutions, in particular, were prompted to quickly shut down their web services. Valtori, Finland's State IT Centre, disabled numerous public web services, including the National Land Survey. The situation was particularly notable in the Netherlands, where the official website of the NCSC, the lower house of parliament (Tweede Kamer), Overheid.nl, the Port of Rotterdam, the Royal Netherlands Football Association (KNVB), major political parties, and many hospital websites were all taken offline.

France's Ministry of Interior disabled regional administration websites, while Germany's federal IT agency, ITZBund, shut down several websites as a precautionary measure, even though no incidents were reported. In Belgium, Foreign Ministry websites were taken offline amid reports of attempted attacks, and in the UK, Edinburgh and Oxford City Councils, the Metropolitan Police website, as well as certain BBC program pages like Doctor Who and The Traitors, were also rendered inactive.

Additionally, certain parts of Wikimedia\/Wikipedia systems were restricted for updates, and Pinboard, the Something Awful forum, and the 4chan website were temporarily limited to read-only access. Codmon, a Japanese child-care and parent communication app, was completely shut down, and Studio web design tools and some Sakura Internet services were also restricted. Furthermore, Nintendo-related services and several school and hospital systems in Europe were among the services that were disabled. However, major commercial platforms like leading social media or search engines did not experience widespread outages, and these disconnections were primarily concentrated on government, public, and independent platforms.

This critical security vulnerability was discovered with significant contributions from Artificial Intelligence (AI). It was independently found by Calif security company under its "Patch the Planet" project using OpenAI models, and by Wiz company using Gemini\/GPT models. However, due to early leaks of information about this vulnerability before official patches were released, initial signs of attacks were reported, and Cloudflare observed such early activities and took temporary measures to update its security firewall rules.

Official security updates, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, were released today around 14:00 UTC (10:00 AM Eastern Time). However, since official support for PHP 8.1 and older versions has ended (end-of-life), no official security solutions will be released for them, and only a limited number of source code backports are available. It is also noted that not updating older versions poses a long-term risk.

Official solutions are already available from php.net and through Linux distributions, and website owners and hosting providers must update the PHP runtime itself and restart Apache or PHP-FPM systems. It is emphasized that since this vulnerability exists within the system engine itself, it cannot be fully mitigated by ordinary software-level or CMS maintenance steps, and while regular web users do not need to take any action, system operators bear full responsibility for this.