Skip to content
Critical PHP Vulnerabilities Prompt Global Website Shutdowns

Critical PHP Vulnerabilities Prompt Global Website Shutdowns

First seen 22 Oct 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 19:14 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities allowing remote code execution.
  • •Approximately 70% of websites, including major platforms, are affected by these vulnerabilities.
  • •Emergency patches were released on October 21, 2026, following a surge in hacking attempts.

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, leading to widespread shutdowns of websites globally. These vulnerabilities, collectively known as PHP2Shell, allow unauthenticated remote code execution, affecting approximately 70% of websites, including major platforms like WordPress and Joomla. Following the announcement, millions of hacking attempts were reported, with a surge in exploitation attempts noted by Cloudflare. Governments and organizations across Europe, including the Netherlands and Finland, took their websites offline as a precaution. The vulnerabilities had remained hidden for over a decade and were uncovered using AI technology. Emergency patches were released on October 21, and organizations are urged to update their PHP installations immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Emergency patches released
The PHP Foundation released critical updates for vulnerabilities CVE-2026-109618 and CVE-2026-109619, urging immediate application.
Punchng
2026-10-21
Public disclosure of vulnerabilities
CVE-2026-109618 and CVE-2026-109619 were publicly disclosed, leading to a surge in hacking attempts across the internet.
Techradar
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Widespread website shutdowns
Governments and organizations globally took websites offline as a precaution against potential exploitation of the vulnerabilities.
Euronews

More articles in this cluster (54)

Following this threat?

Track Amazon and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (60)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions from 5.4 and later are affected by the vulnerabilities.
Is there evidence of active exploitation?
Yes, millions of hacking attempts were reported following the public disclosure of the vulnerabilities.
What immediate actions should organizations take?
Organizations should apply the emergency patches released for PHP immediately or take their systems offline until they can be updated.