New Delhi: Millions of attempts to exploit critical flaws in PHP have intensified a worldwide rush to secure websites, as governments and businesses suspend online services to install emergency fixes. Cloudflare reported a sharp increase in attempted attacks after the vulnerabilities became public, turning a software security warning into an urgent challenge for organizations dependent on the widely used web technology.
The disruption has affected public services, financial institutions and other website operators, although a precautionary shutdown does not establish that a system has been breached. Updates released on October 21, 2026, address two vulnerabilities that can allow attackers to run code on affected servers without first logging in.
Cloudflare records rapid surge in exploitation attempts
The chief executive of Cloudflare, Matthew Prince, described how quickly the threat escalated around the public announcement. According to Reuters, the company observed thousands of attempts during the preceding 10 hours, tens of thousands within 45 minutes afterwards, hundreds of thousands within two hours and subsequently millions.
Those figures describe attempted exploitation observed across Cloudflare’s network, rather than a verified count of compromised websites. They nevertheless illustrate the narrow window available to administrators once information about a serious vulnerability begins circulating publicly.
The weaknesses, widely referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU’s security advisory assigns both a severity score of 9.2 out of 10 and warns that publicly circulating technical details and demonstration exploits increase the danger to unpatched systems.
PHP operates behind the scenes on web servers, supporting applications such as WordPress, Drupal, Joomla and MediaWiki, the software used by Wikipedia. Because the flaws lie in PHP itself, a website can be exposed even when its own application code contains no corresponding vulnerability.
Researchers at Wiz said their investigation into PHP2Shell demonstrated both remote code execution and the disclosure of sensitive information from server memory. Depending on the vulnerability and configuration, exposed information could include passwords, authentication tokens and application programming interface keys.
The underlying problems involve PHP’s handling of memory and errors during web requests. In simplified terms, interrupted processing can leave invalid or outdated internal data that the software subsequently treats as usable, creating opportunities for attackers to manipulate its behaviour.
Wiz said advanced artificial intelligence helped researchers turn longstanding weaknesses into working exploits by reducing the effort needed to combine bugs and adapt attacks to different applications. Its findings underline a growing security challenge: software defects that were previously difficult to exploit may become more accessible as research tools improve.
Governments and companies take websites offline
The defensive response has caused substantial disruption, with organizations choosing temporary unavailability while security work proceeds. Reuters reported shutdowns across Europe, Japan and elsewhere.
Germany disabled several federal websites, while France suspended prefecture websites and Belgium took foreign ministry sites offline. In the Netherlands, affected organizations included the Port of Rotterdam, hospitals, political parties and the government information portal Overheid.nl.
Japan’s response extended to government services and companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway. Orange also suspended selected websites and applications across parts of its business.
Wikimedia took some supporting systems offline, while the Internet Archive temporarily closed its portal before restoring access. These actions should not be interpreted as evidence that every service operated by the organizations was unavailable.
Several authorities explicitly described their actions as preventive: Germany reported no known security incidents, Finland said its shutdown was not caused by a data breach, and Canada reported no indication of compromised systems or information. The distinction matters because service interruptions and successful cyberattacks are separate developments.
What website operators need to fix
The PHP developers’ advisory identifies PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the releases containing fixes. It warns that installations serving web requests are at risk across several common configurations, with Apache’s mod_php considered particularly exposed because a demonstrated attack can begin before application code runs.
For website owners, the practical implication is that updating a content management system or its plug-ins alone does not establish that the underlying PHP installation is secure. Operators need to confirm that their hosting provider or server administrator has applied the relevant PHP fix.
Older installations require particular attention because PHP 8.1 and earlier no longer receive routine updates from the project. Some operating system suppliers and long-term support vendors provide backported fixes, while the PHP team has also supplied limited source patches for certain older branches.
CERT-EU recommends isolating affected internet-facing applications when immediate patching is impossible, keeping them disconnected until the fix has been installed and verified. It also warns that PHP can be embedded in third-party products, meaning an organization’s exposure may extend beyond websites its own developers maintain.
Temporary configuration changes can reduce exposure to specific attack methods, but the official guidance does not treat them as a complete remedy. For Indian website owners and institutions using affected PHP deployments, the same technical requirement applies: identify the underlying software, obtain the appropriate update and verify the fix before restoring exposed services.