Hundreds of EU and Government websites go offline over critical PHP flaws

A massive security breach detected in the core of the PHP language caused a wave of preventive shutdowns in institutional portals across Europe yesterday. The cybersecurity community has already dubbed it PHP2Shell due to its significant impact.

The alert was triggered by the identification of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a CVSS v4.0 rating of 9.2 out of 10, which allow cybercriminals to execute remote code (RCE) without the need for authentication.

The flaw lies in the way the PHP engine itself processes requests. Therefore, the vulnerability is activated before the website code is executed. Thus, security plugins, CMS-level application firewalls, or maintenance modes within WordPress or Drupal cannot stop it.

To make matters worse, i t affects almost all versions of PHP because the issue resides in legacy code that has been hidden in the language for more than a decade .

Furthermore, the severity of the incident lies in the immense reach of PHP, the technology that supports nearly 70% of websites globally and platforms like WordPress, Drupal, and Joomla.

With the circulation of proof-of-concept of active attacks before patches were released and applied, European cybersecurity centers urged to immediately isolate any exposed server .

The impact of the alerts issued by the European Union's cybersecurity team (CERT-EU) resulted in the temporary shutdown of public platforms in multiple countries in the regi on.

In the Netherlands, the National Cyber Security Centre (NCSC) itself disconnected its official portal, a move followed by the central administration portal (Overheid.nl), the Port of Rotterdam's website, and the institutional pages of the main political parties.

In Germany, the federal administration's IT service provider (ITZBund) preventively took down several government websites.

The Office of the Government of the Czech Republic ordered the shutdown of the vlada.cz portal to perform a secure update, while in Finland, the Digital Services Center (Valtori) and in Denmark, the municipal management network (Kombit) temporarily deactivated administrative and school communication platforms.

Similar preventive shutdowns affected prefectures in France, ministries in Belgium, and various hospital and university centers in the region.

A massive security breach detected in the core of the PHP language caused a wave of preventive shutdowns in institutional portals across Europe yesterday. The cybersecurity community has already dubbed it PHP2Shell due to its significant impact.

The alert was triggered by the identification of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with a CVSS v4.0 rating of 9.2 out of 10, which allow cybercriminals to execute remote code (RCE) without the need for authentication.

The flaw lies in the way the PHP engine itself processes requests. Therefore, the vulnerability is activated before the website code is executed. Thus, security plugins, CMS-level application firewalls, or maintenance modes within WordPress or Drupal cannot stop it.

To make matters worse, i t affects almost all versions of PHP because the issue resides in legacy code that has been hidden in the language for more than a decade .

Furthermore, the severity of the incident lies in the immense reach of PHP, the technology that supports nearly 70% of websites globally and platforms like WordPress, Drupal, and Joomla.

With the circulation of proof-of-concept of active attacks before patches were released and applied, European cybersecurity centers urged to immediately isolate any exposed server .

The impact of the alerts issued by the European Union's cybersecurity team (CERT-EU) resulted in the temporary shutdown of public platforms in multiple countries in the regi on.

In the Netherlands, the National Cyber Security Centre (NCSC) itself disconnected its official portal, a move followed by the central administration portal (Overheid.nl), the Port of Rotterdam's website, and the institutional pages of the main political parties.

In Germany, the federal administration's IT service provider (ITZBund) preventively took down several government websites.

The Office of the Government of the Czech Republic ordered the shutdown of the vlada.cz portal to perform a secure update, while in Finland, the Digital Services Center (Valtori) and in Denmark, the municipal management network (Kombit) temporarily deactivated administrative and school communication platforms.

Similar preventive shutdowns affected prefectures in France, ministries in Belgium, and various hospital and university centers in the region.

Become a premium member for free!