PHP2Shell Vulnerabilities Took Government Sites Offline Across Europe
Two bugs in PHP, the PHP2Shell vulnerabilities, let an attacker run their own code on a web server with one web request and no login (Help Net Security). Details leaked on 20 October 2026, and government sites in the Netherlands, France, Denmark and Finland went offline until PHP shipped fixed versions on 21 October.
What the PHP2Shell vulnerabilities are
PHP runs about seven in ten websites. The two bugs, CVE-2026-109618 and CVE-2026-109619 (a CVE is the public ID for a security bug), sit in how PHP cleans up when a request runs out of memory or crashes, and the server runs what you sent it before the site’s own code starts (php.net). PHP has known about one of them since 2024 and couldn’t agree a fix, which the PHP Foundation now calls “a structural failure” (The Next Web).
Ryan Austin at the security firm Calif (Wikipedia) and a team at Wiz, using the AI models Gemini 4 Argon and GPT-5.6 Sol (Wiz), found them separately in August. The fix was scheduled for 21 October at 14:00 UTC (3pm in the UK). On 20 October the bugs appeared on Hacker News, watchTowr posted about them on X, and Calif put out a demo video by mistake. PHP published 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:34 UTC, 26 minutes early.
Who went offline
The Netherlands took down DigiD (the national login), MijnOverheid, Overheid.nl and the parliament website on Wednesday morning, before a fix existed (NL Times). Matthijs van Amelsfort of the Dutch NCSC said there was no sign of attacks, but traffic showed people scanning sites for the PHP2Shell vulnerabilities (NL Times). Most were back by Thursday morning.
France’s Interior Ministry took every prefecture (local government office) website offline (The Connexion). Denmark’s council IT firm Kombit shut the national school messaging platform, and Finland’s state IT provider Valtori took government public services offline (Reuters factbox).
What happened after the patch
Amazon’s threat team saw attack attempts on 17 October, four days early (Help Net Security). Palo Alto’s Unit 42 counts 22.6 million PHP servers still reachable from the internet. In one European government body, attackers used an AI agent to pull stored passwords and the secrets behind two-step login within two hours of getting in (Unit 42).
Cloudflare’s Matthew Prince told Reuters on 23 October that he knows of “a bunch of additional severe vulnerabilities” and expects “a couple of years” where “every single week it’s going to feel like the sky is falling” (Reuters via TimesLive).
FAQ
How do I know if my site has the PHP2Shell vulnerabilities?
Any PHP older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 that serves web requests is affected, however it runs (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP). Run php -v on the server. If someone else runs the server, check their status page. Most big hosts patched on 21 October.
Is there a fix other than updating PHP?
No complete one. PHP’s release notes say updating is the only safe choice. Web firewalls (filters that sit in front of a site) added rules for the known attack shapes, which helps until you patch. The UK NCSC says if you can’t patch or filter quickly, take the system offline.
Why did the PHP2Shell details leak early?
The fix was scheduled for 21 October at 14:00 UTC (3pm in the UK). On 20 October the bugs turned up on Hacker News, watchTowr posted about them on X, and Calif, one of the firms that found them, put out a demo video by mistake. PHP shipped the fix 26 minutes early.
The bugs waited two years for a fix and the models found them in one summer, so the next PHP2Shell has probably already been found.