Newsletters
Governments and companies across the world are taking websites and online services offline as emergency security patches address two critical vulnerabilities in PHP, a programming language used by nearly 70% of websites, while attackers ramp up attempts to exploit the flaws.
Affected services include the Netherlands’ DigiD digital identity platform, government websites in Finland, France and Germany, parts of Wikipedia, and some online services operated by Japan’s Mitsubishi UFJ Financial Group.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as "php2shell," could allow attackers to execute malicious code on vulnerable servers without authentication, potentially exposing sensitive data or disrupting digital services.
Authorities warned that the php2shell vulnerabilities could enable attackers to execute code remotely without user authentication under certain conditions, creating risks of unauthorized access, data breaches and interruptions to digital services.
The PHP Foundation has acknowledged that delays in addressing the problem exposed a serious weakness in its security response, describing the stalled process as a "structural failure."
Not every website is exposed. Systems that do not run PHP on their own servers, or whose operators can install the security updates promptly, may remain online without the same disruption.
Cloudflare CEO Matthew Prince reported millions of exploitation attempts after the vulnerabilities became public on Wednesday, with activity escalating sharply within hours of the disclosure.
Prince outlined the rapid increase in malicious activity in a post on X, explaining that Cloudflare detected thousands of exploitation attempts in the 10 hours before the vulnerabilities were publicly disclosed.
That figure climbed to tens of thousands within 45 minutes of the announcement, reached hundreds of thousands within two hours and eventually rose into the millions, according to Prince.
The vulnerabilities affect PHP's underlying runtime, meaning updating website code or individual plugins alone will not resolve the problem. Administrators must update the PHP software running their applications or contact their hosting providers to ensure the fixes are installed.
Cloudflare deployed web application firewall protections in early October, around nine hours before public disclosure. The company said its protections were available automatically to customers using its firewall services, including those on free plans.
The company also reported that attackers modified their payloads in attempts to bypass its defenses. It urged customers to install the PHP updates even if additional protections were already in place.
The PHP security team reported that it had not identified any functional exploits at the time of public disclosure.
The PHP Foundation said developers first identified signs of the vulnerabilities in 2024 but struggled to develop a fix without disrupting the extensive ecosystem of software built around the language.
A small team of core developers with specialized knowledge of PHP's engine was already handling multiple responsibilities, while the absence of a known path to remote code execution complicated decisions over how to proceed.
The result was months of work that repeatedly stalled and restarted, the foundation explained in a blog post accompanying the emergency patches.
"We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources," the foundation said.
The issue returned to the forefront on Aug. 11, after cybersecurity firm Calif and OpenAI independently reported the underlying vulnerability. Calif demonstrated that it could enable remote code execution, prompting developers to treat the problem as a top security priority.
The vulnerabilities were subsequently disclosed by Calif.io, Wiz, OpenAI and Quarkslab. They affect web servers running PHP 5.4 or later, according to the security advisory.
The flaws involve how PHP handles memory when an HTTP request fails unexpectedly. Under certain conditions, the software may use improperly initialized data or refer to memory that has already been released, potentially allowing attackers to crash processes, expose information or run malicious code.
The security threat has prompted precautionary shutdowns across Europe, Asia and Australia as organizations work to install the fixes.
In the Netherlands, authorities temporarily shut down the DigiD digital identity service and MijnOverheid, which residents use to access government services. The country's National Cyber Security Center also took its website offline.
Finland's state IT provider Valtori disconnected public government web services, while France's Interior Ministry temporarily disabled prefecture websites. Germany's federal IT provider ITZBund also took several websites offline.
In Japan, the Finance Ministry temporarily suspended some website content and services while security measures were implemented. The Health, Labor and Welfare Ministry also took a website used to share contact information for long-term care service providers offline as a precaution.
Prime Minister Sanae Takaichi urged website operators to check whether their systems use PHP and prepare to install the patches. She also recommended temporarily suspending website functions if immediate updates were not possible.
Australia's Signals Directorate confirmed that its cybersecurity website, cyber.gov.au, was among the government sites affected by the PHP issue.
The Wikimedia Foundation, which operates Wikipedia, temporarily took supporting services Toolforge and Cloud VPS offline. The platforms host tools and projects used by volunteer developers, and the shutdown caused some parts of Wikipedia to become unavailable on Wednesday.
Japan's Mitsubishi UFJ Financial Group also temporarily suspended some internet services as part of its emergency response.
U.S. authorities have also warned organizations to act quickly to protect their systems. The FBI's cybercrime unit warned that the vulnerabilities could allow malicious actors to execute code remotely, putting sensitive information and network security at risk.
The FBI recommended taking websites offline if organizations could not update them immediately. The National Security Agency likewise urged organizations to patch vulnerable systems without delay or disconnect them from the internet.
The vulnerabilities have also prompted scrutiny across the cryptocurrency industry.
Blockchain security firm SlowMist reported that its MistEye service identified 793 domains with direct PHP fingerprints among 1,488 domains assessed. The company urged cryptocurrency exchanges, decentralized finance platforms and wallet providers to check their systems and apply the updates.
Intersect, an organization supporting the development and governance of the Cardano blockchain, temporarily took its Members Area offline while assessing potential exposure.
Coinbase Chief Security Officer Jeff Lunglhofer reported that the company had found no evidence of exposed PHP instances after conducting a security review.
Digital asset infrastructure company BitGo also reported that its platform was unaffected.
Binance co-founder Changpeng Zhao, meanwhile, warned internet users to be "extra careful" when visiting websites over the following days, noting that some administrators might not have installed the latest security patches.
OpenAI has also released a Codex skill through GitHub to help website operators identify potentially vulnerable PHP versions and determine which updates they need.
Türkiye's Cyber Security Directorate has launched preventive measures to address the vulnerabilities in PHP. The directorate said it had begun security scans across systems nationwide, prioritizing public institutions, and was notifying relevant organizations to take urgent action.
Emergency security notices have been distributed to institutions and critical infrastructure operators through the Cyber Incident Response Teams (SOME) Communication Platform, with technical and administrative measures outlined in the alerts.
The directorate urged public agencies, private companies and system administrators to review internet-facing infrastructure and apply the available security updates immediately. It also stressed the need to keep systems up to date, restrict unnecessary external access and introduce additional safeguards for services where necessary.
The directorate said it would continue monitoring developments and coordinating with relevant institutions to protect Türkiye's digital infrastructure and maintain the continuity of critical services.
No specific website in Türkiye has been publicly identified as compromised or taken offline because of the vulnerabilities as of Thursday.
Set as preferred source
Set as preferred source
1 min read
1 min read
