Millions of PHP Cyber Attacks Trigger Global Emergency as European Governments Take Systems Offline
From thousands, the number jumped to tens of thousands within 45 minutes of the announcement, to hundreds of thousands within two hours, and now to millions,
stated Matthew Prince, chief executive officer of Internet infrastructure company Cloudflare, describing a massive surge of automated threats targeting critical software vulnerabilities.
A pair of severe security flaws in the widely used PHP programming language has forced governments, institutions, and businesses across Europe to take web servers offline. The vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619 and collectively tracked as PHP2Shell, carry a severity score of 9.2 out of 10. State agencies and digital infrastructure providers across Italy, the United Kingdom, Germany, France, Finland, and the Netherlands scrambled to deploy emergency patches or completely sever public access to prevent potential server takeovers.
Government Portals and Public Services Suspended Across Europe
Precautions across the continent led to widespread digital blackouts as authorities rushed to implement emergency updates. At least 32 of the British government’s digital services are inaccessible, while four others are only partially operational, as indicated on UK government websites. The Office for Budget Responsibility temporarily obscured its website, and several British Broadcasting Corporation series went dark.
Netherlands authorities disconnected institutional web pages. Finland’s government web services were also affected. In France, institutions were “turned off”. Meanwhile, Germany’s Federal Office for Information Security prompted multiple ministry sites to go offline, though Digital Karsten Wildberger confirmed that federal administration systems showed no signs of actual compromise.
Emergency Patches Released After AI-Assisted Discovery
The PHP project issued extraordinary software updates for still-supported versions to address the flaws, which stem from memory management defects initially flagged during an external security audit in 2024. Developers at the time could not deploy a satisfactory fix due to compatibility risks and potential denial-of-service triggers. The situation accelerated on August 11, 2026, when a researcher named Ryan A from security firm Calif reported an arbitrary code execution vector linked to the original 2024 flaw. OpenAI submitted independent findings regarding the same root cause on that same day, followed by additional vulnerability vectors from Wiz on August 24 and OpenAI again on September 18.
The public disclosure arrived before all necessary patches were fully finalized, opening a precarious window where attackers possessed exploit methods while defenders awaited fixes. Stefano Zanero of the Polytechnic University of Milan warned that legacy applications developed years ago face severe upgrade hurdles, as migrating older software to a patched version often requires extensive application rewrites or complex modifications.
Frequently Asked Questions About the PHP2Shell Vulnerability
What exactly is the PHP2Shell vulnerability?
PHP2Shell consists of two critical security flaws tracked as CVE-2026-109618 and CVE-2026-109619, both receiving a severity score of 9.2 out of 10. Combined, these vulnerabilities allow remote attackers to execute code and potentially seize complete control of exposed web servers.
How many websites and services are affected worldwide?
Security firm Wiz estimated that PHP vulnerabilities potentially affect 70 percent of the internet. Cloudflare CEO Matthew Prince reported that his network recorded millions of automated exploitation attempts within hours of the public disclosure.
What actions should system administrators take immediately?
Authorities advise organizations to inventory PHP applications, apply the emergency patches released on October 21, 2026, and isolate vulnerable systems from public networks immediately if updates cannot be performed right away.
Related reading