Global alert over two critical PHP flaws forces government websites offline

The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. CISA calls them “php2shell.” They are critical because they enable remote code execution, meaning an attacker can make a vulnerable server run code from a distance without first logging in.

The article does not describe the exact technical exploit steps. It does establish the key danger: the flaws affect PHP installations serving web requests. An attacker who successfully abuses the vulnerable system could therefore cause the server to execute unauthorised instructions. The lack of authentication makes the exposure especially serious.

Proofs of concept are already circulating publicly, and security firms have reported attack attempts. No successful exploitation has been confirmed so far, but the public demonstrations increase the likelihood of real attacks. PHP’s development team released fixes and urged users to update immediately.

The vulnerabilities are rated 9.2 out of 10, placing them in the critical range. Their reach is broad because they affect all PHP installations serving web requests. PHP powers much of the internet, so a weakness in its request-handling environment can expose many kinds of public websites and services.

The article specifically names WordPress, Drupal, and Joomla as affected platforms. These platforms can use PHP installations to process requests and produce website responses. The risk is therefore not limited to one product or one country. Any exposed installation that has not received the relevant fix may require urgent attention.

Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Governments and security agencies urged organisations to patch quickly. Organisations unable to patch immediately were told to isolate exposed applications from the internet while they prepared an update.

Governments and companies took websites offline as a precaution against a critical, remotely exploitable PHP weakness. The flaws can let attackers run code on servers without authenticating. Removing a public service from the internet reduces the opportunity for an attacker to reach its vulnerable PHP installation.

The risk increased after proofs of concept began circulating publicly. Security firms reported attack attempts, although none had confirmed a successful compromise. With a 9.2 severity score and broad exposure across PHP web installations, organisations faced pressure to act before they could fully test or install the fixes.

The Netherlands took offline portals including DigiD and parliamentary websites. Finland, France, Denmark, and Australia also removed public services or sites, while major Japanese platforms were affected. The shutdowns were temporary protective measures, not evidence that every offline service had been successfully attacked.

The European Union’s computer emergency response team advised organisations that could not install the fix immediately to isolate exposed applications from the internet. This means preventing public internet access to the vulnerable service while keeping work underway on a permanent update.

Isolation is an emergency risk-reduction step. The vulnerabilities affect PHP installations serving web requests, so removing those applications from internet reach blocks the normal path by which an outside attacker could send requests. The article does not specify a particular isolation technology or network design.

The longer-term action is to install one of the fixed PHP releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. The PHP development team urged immediate updating. CISA and the UK’s National Cyber Security Centre also called for patches as soon as possible, while the NSA urged organisations to prepare.

The article does not identify the researchers or organisations that discovered the two vulnerabilities. It also does not give a separate disclosure timeline. The flaws are identified by CVE-2026-109618 and CVE-2026-109619, and CISA gave them the name “php2shell.”

PHP’s development team handled remediation by releasing fixes in four supported PHP branches. The available versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The team urged users to update immediately. Security firms supplied information about attack attempts, but the article does not name those firms.

The European Union’s computer emergency response team advised isolation when patching was delayed. The NSA urged organisations to prepare, while CISA and the UK’s National Cyber Security Centre called for rapid patching. CISA also assigned the public “php2shell” name. No confirmed successful attacks were reported in the article.

PHP is the programming language underlying much of the internet, and platforms such as WordPress, Drupal, and Joomla can run using PHP. This creates a shared dependency: the platform supplies website features, while PHP processes relevant server-side instructions and web requests.

If the PHP installation handling those requests contains a remotely exploitable flaw, an attacker may target the PHP layer rather than a specific site feature. Because the vulnerability can permit unauthenticated remote code execution, the platform may be exposed wherever it depends on an affected PHP installation serving public requests. The article does not claim every individual site was compromised.

The broad dependency explains the urgent response. The flaws affect all PHP installations serving web requests, and public proofs of concept were circulating. Organisations using these platforms needed to update PHP or isolate exposed applications. The listed fixed versions provide the route to remediation.

PHP is a programming language used on web servers. The article identifies it as the language powering much of the internet. In general, server-side code runs before a page reaches a visitor. It can process a request, use application logic, and produce the content or service response that the user receives.

For example, when someone requests a page, a server can use PHP code to decide what information to prepare and return. Platforms such as WordPress, Drupal, and Joomla use PHP installations as part of serving web requests. The browser receives the resulting response, rather than directly running the server’s PHP code.

This server role explains the security risk. A flaw in PHP can affect applications that depend on it, especially when they are exposed to internet requests. The two reported vulnerabilities allow unauthenticated remote code execution. The PHP team released fixes, and organisations were urged to update or isolate exposed applications.