PHP2Shell Security Flaws Trigger Global Website Shutdowns

Several government, educational and other institutional websites across the world were temporarily taken offline after cybersecurity experts disclosed critical vulnerabilities in PHP, a widely used programming language that powers many websites and web applications. Known collectively as PHP2Shell, the flaws were publicly disclosed on October 21, 2026, and could allow unauthenticated attackers to execute malicious code remotely or access sensitive information from affected servers. The vulnerabilities affect multiple PHP versions, prompting organisations to temporarily disable exposed systems when immediate security updates could not be applied.

The PHP security team has released patches, while cybersecurity agencies have urged organisations to identify vulnerable servers and install the updates immediately. Reports indicate that websites and online services in countries including Germany, France, Belgium, the Netherlands and Finland were taken offline as a precaution. The US National Security Agency has also advised organisations to prioritise security updates for internet-facing systems that rely on PHP. Experts warn that unpatched servers could be vulnerable to remote attacks, making prompt updates and security checks essential.