PHP2Shell Forces Government Websites Offline Across Europe

Executive Summary

Governments across Europe took websites offline on 21 October 2026 to shield them from PHP2Shell, two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code on web servers without logging in. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic all pulled sites while the PHP project shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The US National Security Agency told organisations that cannot update at once to take systems offline. Every shutdown reported so far was described as precautionary. Amazon says the flaws are now being exploited broadly.

Which Government Websites Went Offline

The list grew through Wednesday afternoon, according to a published report of official statements. In Germany, the digital ministry said federal IT provider ITZBund removed several websites as a purely precautionary step and that no security incidents were known. France’s Interior Ministry took down prefecture websites, the local administrative offices, until a patch was available. Belgium’s foreign ministry pulled its sites after reports of attacks, although the country’s cybersecurity centre said it had recorded none against Belgian websites. The Czech government went offline at 19:00 local time on the advice of its cyber watchdog. Finland’s state IT centre Valtori shut public government services and said it had found no attempt to exploit the flaws.

The Dutch list was the longest.

Organisations there followed the Dutch National Cyber Security Centre, which took its own site down. The Port of Rotterdam, the government portal Overheid.nl, football association KNVB, the five largest political parties and many hospitals went dark. Japan’s prime minister Sanae Takaichi also warned about the risk on social media, a separate report said.

A Flaw That Fires Before the Website’s Own Code

The scale of the response comes down to where the bug sits. PHP’s advisory says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. On mod_php an unauthenticated request can trigger the attack before any application code runs. A hardened CMS or a login page offers no protection. PHP says only an update fully fixes the problem.

Agencies drew the obvious conclusion. “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” the NSA said. CERT-EU, the UK NCSC and Sweden’s CERT-SE gave similar isolate-or-patch advice.

Precaution Met Real Attack Traffic

None of the governments has reported a breach. The attacks are real, though. Amazon Threat Intelligence recorded a first exploitation attempt on 17 October, four days before the fix. It now calls PHP2Shell broadly exploited. Cloudflare said it saw attack traffic aimed at its customers before the release. The Dutch NCSC warns that PHP is also embedded in appliances and management interfaces where administrators can’t update it themselves.

No government has given a full restore date. Nobody has published a count of breached organisations.

Twenty-Three Hours Without a Patch

The shutdowns trace back to a disclosure that slipped. The PHP Foundation says the CVE IDs began circulating around 15:00 UTC on 20 October. It moved the release to 14:00 UTC the next day instead of shipping at once, because distributors were still packaging the fix. That left roughly 23 hours in which a public warning existed and no installable patch did. Switching sites off was the only complete control. At 07:41 UTC on 21 October Chainguard published built images containing the fix, more than six hours before the coordinated release, which the Foundation said let any attacker study it early.

References

1. Critical remote code execution vulnerabilities, update now
2. Today’s PHP Security Release, and How We’re Strengthening PHP Security
3. NSA Advisory: PHP Updates
4. Security Advisory 2026-018
5. Critical security issue affecting PHP
6. php2shell vulnerabilities, operational information
7. Kritiska sårbarheter i PHP
8. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
9. Cloudflare deploys protections against php2shell vulnerability

This post is also available in: