Critical PHP Flaws Force Government Sites Offline Before Emergency Patch

PHP's development team scheduled an out-of-cycle security release for 14:00 UTC on October 21, 2026, to fix two critical vulnerabilities after details leaked online a day earlier, according to The Hacker News and the security firm Sansec. The flaws were tracked as CVE-2026-109618 and CVE-2026-109619 and were informally nicknamed "PHP2Shell" by researchers, a name PHP's own team did not adopt, The Hacker News reported.

What the vulnerabilities are

According to Sansec's technical write-up, CVE-2026-109618 is a use-after-free bug in PHP's upload-progress handling that can leak server memory — including passwords, session tokens and TLS private keys — through the PHPSESSID cookie, in a manner the firm compared to the 2014 Heartbleed bug. CVE-2026-109619 is a separate use-after-free triggered when a fatal error occurs during memory exhaustion, combined with type confusion in PHP's OPcache, which Sansec said enables remote code execution. Both bugs are reached through multipart/form-data requests, the format web pages use for file uploads.

The UK's National Cyber Security Centre (NCSC) described the risk in its October 21 advisory as allowing an attacker to "execute commands on any web server running PHP" without needing to log in, and rated the issue critical.

Why governments and platforms went offline

Because PHP underlies a large share of the web, several organisations chose to shut down public-facing sites rather than wait for the patch. Techzine reported that Dutch government services including MijnOverheid, DigiD and parliamentary systems were temporarily taken offline, and the news wire story carried by KSL said cybersecurity agencies in the Netherlands and Finland pulled government sites down as a precaution. Techzine also reported that the UK's NCSC and the US Cybersecurity and Infrastructure Security Agency (CISA) issued alerts urging administrators to patch or disable affected systems, while Wikipedia and Meta kept running by applying modified PHP runtimes and web-application-firewall rules instead of going dark.

Sansec reported that PHP core developer Gina Peter Banyard described taking servers offline before the patch arrived as the most sensible option for organisations unable to apply a fix immediately — advice several Dutch bodies followed.

Cloudflare said it began seeing exploitation attempts before the official patch was released. According to the KSL report, Cloudflare's chief technology officer said the company was observing early attacks and continuously updating its mitigations as new attack methods appeared, describing Cloudflare's protection as a temporary stopgap until PHP's official fix arrived. Sansec separately reported that Cloudflare detected attacks starting at 07:43 UTC on October 21, roughly six hours before PHP's scheduled fix.

• WordPress, Drupal, Joomla and Magento, the content-management and e-commerce systems built on PHP
• Specific versions named by Sansec as confirmed vulnerable: Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11 and Symfony 8.1
• Shared hosting platforms and control panels that bundle PHP, per the NCSC advisory
• Dutch government services DigiD and MijnOverheid, per Techzine

Scale of exposure: estimates vary

What is known and what is not

PHP's team confirmed that PHP 8.2, 8.3, 8.4 and 8.5 would receive official fixes — expected as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to The Hacker News — while end-of-life branches 8.1 and earlier would not be patched by the vendor. Sansec, however, said the underlying flawed code dates back to PHP 5.4.0, meaning many older, unsupported installations likely remain vulnerable with no official fix available. According to The Hacker News, no public proof-of-concept exploit was available as of its October 21 report, and the flaws had not been added to CISA's Known Exploited Vulnerabilities catalog at that time — though Cloudflare's later statement indicated attack attempts were already under way.

Background: how the flaws were found

Sansec's timeline traces the first bug to research that began on August 1, 2026, by a researcher using the handle "Calif" working with OpenAI, who reported it to PHP's security team on August 11. A second, related report came from the Wiz Research team — named by Sansec as Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz — on August 24. Sansec said both research teams credited AI models with speeding up the work of finding and adapting exploits across PHP versions, with one researcher reportedly reaching working exploitation in about a week. Details of the coordinated, embargoed disclosure leaked publicly on October 20, prompting PHP to move up its announcement and set the October 21 patch release.