Global Web Portals Go Offline Following Emergency Critical PHP Security Patches
The vulnerabilities expose core server runtimes across major government and commercial platforms powering an estimated seventy percent of websites worldwide.
Developers released emergency security patches for the PHP scripting language on Oct. 21, 2026, after details of two critical flaws leaked early. The release prompted multiple national and regional governments to pull public web portals offline while administrators applied the updates.
Agencies in Canada, the Netherlands, Finland, Belgium, France and Germany halted services as a protective step. The Wikimedia Foundation also took several systems offline temporarily. Danish municipal IT provider Kombit suspended multiple services, including its national school communication network.
Canadian portals taken down included Statistics Canada, the Canadian Centre for Cyber Security, and provincial sites in Newfoundland and Labrador and Prince Edward Island. Canadian Artificial Intelligence Minister Evan Solomon said federal websites were removed on cybersecurity advice and would return online once patched.
In the Netherlands, offline platforms included the Port of Rotterdam, government portal Overheid.nl, national soccer body KNVB, and hospital services. Websites belonging to the five largest Dutch political parties were also temporarily unavailable.
Tracked as CVE-2026-109618 and CVE-2026-109619, the two remote code execution flaws carry a severity score of 9.2 out of 10. Researchers collectively dubbed the pair PHP2Shell. One flaw stems from unsafe error cleanup, while the other involves reused internal engine states.
The flaws exist within the core runtime rather than application script code. Configurations such as Apache mod_php and PHP-FPM remain exposed regardless of website code quality. Researchers noted that the memory flaws had persisted in PHP engine code since the release of PHP 5 in July 2004.
The PHP Foundation declared that organizations must update immediately to patched versions, including 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Minimal backports were also provided for older branches. The U.S. Cybersecurity and Infrastructure Security Agency advised operators to disconnect unpatched systems until updates finish.
The U.S. National Security Agency warned that the vulnerabilities give attackers direct paths to file systems or databases. The UK National Cyber Security Centre urged administrators to search for backdoors. CERT-EU cautioned that exploit details were circulating publicly.
Researchers at Calif, Wiz and OpenAI identified the flaws under an OpenAI initiative. Cybersecurity firm watchTowr reproduced one flaw internally and said flaw identifiers had leaked before an embargo ended. Cloudflare reported observing early attack attempts aimed at bypassing web firewalls.
System administrators and cloud providers are coordinating emergency update cycles across public and private infrastructure globally. Security teams are auditing internal networks, routers and appliances to locate uncataloged installations as analysts anticipate increased automated scanning.
