Government portals, hospital websites and school services were taken offline Wednesday as organizations rushed to address two critical PHP security vulnerabilities that could let hackers run malicious code on affected servers without logging in.
Precautionary shutdowns disrupted public services across Europe. Reuters reported that the Port of Rotterdam, Dutch hospital websites, French local government websites and Finnish government web services were among those taken offline. Finland’s state IT center said its shutdown was preventive and was not the result of a data breach.
The vulnerabilities, collectively called PHP2Shell, affect software used throughout the internet. PHP runs 69.3% of websites whose server-side programming language can be identified, according to technology tracker W3Techs.
Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws carry severity ratings of 9.2 out of 10. They involve PHP’s memory management and error handling. Successful exploitation can allow attackers to execute code with the permissions of the server’s web worker account.
Order Jonathan Cahn’s New Book, “The Altar of Pergamon” on Amazon.com!
The National Security Agency urged immediate action.
“If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated,” the agency said in its Oct. 21 advisory.
Amazon’s security team identified an attempted exploit against a decoy server dating to Oct. 17, four days before public disclosure and the emergency patches.
“PHP2Shell is now being broadly exploited in the wild,” Amazon security chief CJ Moses wrote Wednesday. Amazon said it remained unclear whether the earlier attempts would have succeeded against real-world systems.
Assessments of the potential scale continued to develop. Security firm Sansec said Thursday that mass exploitation appeared less likely than initially expected because attacks require particular server conditions and knowledge of the target. It continued to urge PHP updates.
Amazon also warned that AI-assisted analysis makes it easier to turn security advisories and patches into working exploits, allowing attackers to move within hours or minutes of disclosure.
The PHP project released fixes Oct. 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
“If you run PHP, it is imperative that you update now,” the PHP Foundation said.
WordPress urged website owners to check with their hosting providers and update PHP promptly. The vulnerabilities are in PHP itself, and no WordPress update is required or planned to address them.
James Lasher, a seasoned writer and editor at Charisma Media, combines faith and storytelling with a journalism background from Otterbein University and ministry experience in Guatemala and at the LA Dream Center. A Marine Corps and Air Force veteran, he is the author of The Revelation of Jesus: A Common Man’s Commentary and a contributor to Charisma magazine. For interviews and media inquiries, please contact [email protected].
