Hundreds of websites go offline as critical PHP flaws trigger global cyber alert

Hundreds of websites and online services were taken offline as governments and major companies scrambled to address two critical vulnerabilities in PHP, a widely used scripting language that powers a large share of the internet.

The flaws, disclosed by PHP's maintainers on Tuesday evening, carry severity scores of 9.2 out of 10 and have raised urgent concerns across the cybersecurity community. Security researchers have reported attempts to exploit the vulnerabilities, increasing fears that attackers could move quickly to target unpatched systems.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been dubbed “PHP2Shell”. PHP released security fixes on Wednesday, prompting authorities and technology companies to urge website operators to update vulnerable systems immediately.

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the PHP security team said in its initial advisory, warning that PHP 8.1 and older versions no longer receive updates from the project.

Governments and companies act

Cybersecurity agencies across the European Union, Germany, Japan, Australia, the United Kingdom and the Netherlands issued urgent warnings, advising website administrators to identify vulnerable systems and apply the available patches.

Some government agencies took websites offline as a precaution before the fixes became available. Major companies and other organisations, including Nintendo, also suspended certain services while assessing and addressing the vulnerabilities.

Cloudflare Chief Technology Officer Dane Knecht said the company was already observing attacks linked to the flaws and had introduced temporary measures to protect some customers.

Jake Knott, head of threat intelligence at cybersecurity firm watchTowr, said researchers were seeing real-world exploitation attempts alongside a range of proof-of-concept tools developed with the help of artificial intelligence.

“Whilst nobody has been successful to date, we don't expect that will last long,” Knott said.

The activity has heightened concerns that attackers could rapidly turn technical information about the flaws into effective exploits, particularly now that security patches are publicly available.

Millions of websites could remain exposed

The scale of the potential threat stems from PHP's widespread use. Some estimates suggest that more than 70% of websites on the internet use the language in some capacity.

PHP supports websites, content management systems, web applications and internal business tools. According to watchTowr, enterprise networks frequently rely on PHP-based systems to manage customer information and business operations, making vulnerable servers a potential entry point into sensitive environments.

The greater concern is that many organisations continue to operate outdated installations that may be difficult or impossible to update.

Joviane Jardim, a senior security researcher at Swedish cybersecurity firm Detectify, said organisations sometimes discover forgotten PHP servers only after attackers locate them.

He explained that the period between the public disclosure of a vulnerability and the availability of a fix can give attackers and defenders a narrow window in which both race to understand the weakness.

Attackers can identify internet-facing servers running PHP, determine their software versions and compare vulnerable code with patched releases to pinpoint weaknesses, Jardim said.

Artificial intelligence could accelerate that process by helping attackers develop working exploits more quickly, leaving organisations with less time to secure exposed systems.

Outdated versions pose the biggest challenge

Security researchers have expressed particular concern about websites running older PHP versions that no longer receive official security updates.

Jardim estimated that roughly half of PHP-powered websites run older versions, while only PHP 8.2 and newer receive security patches.

Such systems may remain vulnerable even as organisations using supported versions install the latest fixes. Sites that have gone years without maintenance are especially concerning because their owners may not even know that the underlying software needs attention.

The problem extends beyond prominent websites. Forgotten marketing pages, hosting control panels, internal applications and devices that rely on PHP can all create potential openings if they remain exposed and unpatched.

For organisations, the immediate priority is to identify every system running PHP, determine whether it is affected and install the appropriate security updates. Where updates are not immediately possible, administrators should assess exposure and apply suitable protective measures.

The episode underscores a broader cybersecurity challenge: identifying and securing neglected digital infrastructure can be just as important as fixing newly discovered flaws.

As attackers look for vulnerable servers, security experts say organisations cannot afford to rely on knowing only about the systems they actively manage. The greatest risks may lie in the ones they have forgotten.