Government websites in Europe went dark after a pair of critical remote code execution flaws in PHP hit the wire on October 21, 2026. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called "php2shell," let an unauthenticated attacker run arbitrary code on a PHP server. CISA added both flaws to its Known Exploited Vulnerabilities catalog five days later.
PHP powers a large share of the web, and the affected versions span every installation serving web requests. That includes Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, according to the CISA advisory. PHP itself rates Apache with mod_php as the highest-risk configuration.
This story matters right now because the flaws are already being exploited in the wild, not just theorized. CISA's KEV listing means federal agencies must patch within set deadlines, and the agency tells organizations that cannot patch immediately to take PHP-based systems offline. For a language that underpins WordPress, Drupal, Laravel and countless internal tools, that is a real choice between downtime and compromise.
The fix is simple on paper. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For shops still running PHP 8.1 or older, which are unsupported, the advice is harsher: take systems offline until patched or updated. A web application firewall may buy time, but CISA does not present it as a fix.
The patch window is shorter than most teams expect
CISA's alert, last revised October 26, 2026, walks through a detection playbook alongside the patching guidance. The agency released a SIGMA detection rule aimed at spotting suspicious activity in log sources, and it tells defenders to watch for PHP worker processes launching shells or downloading tools. That detail matters. Attackers who get code execution on a PHP server rarely stop at a proof of concept; they use the shell to pull in second-stage payloads.
The partner list behind the alert spans eight national cyber agencies. The NSA, the UK's NCSC, Australia's ASD ACSC, the Netherlands' NCSC-NL, New Zealand's NCSC, Canada's Cyber Centre and France's ANSSI are all referenced alongside PHP's own security advisory. When that many agencies sign onto the same message within a week, it signals the flaw is being used against real targets, not sitting in a lab.
The BBC reported that websites worldwide came down as the vulnerabilities circulated, with a fix issued the Wednesday afternoon following disclosure. Government sites in Europe were among the first pulled offline, Reuters noted, as the EU agency warned that sites may need to be taken down while PHP prepared patches. The sequence is familiar. Disclosure, then panic patching, then cleanup.
Why PHP is a bigger target than its reputation suggests
PHP's image as a "legacy" language understates its footprint. It still runs a large share of the public web, including the content management systems that power newsrooms, government portals and small business storefronts. Those sites are often maintained by small teams with limited patching capacity, which is exactly the population that misses a five-day window.
CISA's inventory guidance reflects that reality. The agency tells organizations to find and inventory systems running any version of PHP, noting that PHP is often a component of other software and its prevalence may not be directly observable. That caveat is doing a lot of work. A team can patch its own codebase and still get hit through a dependency, a plugin or a hosting control panel that bundles an old PHP binary.
The KEV listing changes the calculus for US federal agencies, which must remediate catalogued flaws on a fixed timeline. For everyone else it functions as a strong signal. A vulnerability on the KEV list is not a theoretical risk; CISA only adds flaws it has evidence are being exploited. Security teams that treat KEV entries as a patching priority queue are making a defensible call.
What defenders should do this week
First, inventory. Find every PHP installation, including ones buried inside other products, and map versions. Second, patch internet-facing systems first, then work inward. Third, for anything that cannot be patched quickly, take it offline rather than rely on a WAF. CISA's wording is deliberate here: a WAF "may provide some protection," not a guarantee.
Monitoring comes after the patch, not before. The SIGMA rule and the guidance on watching for shell-spawning PHP workers are meant to catch compromises that already happened, not to block new ones. Teams that only deploy detection without patching are betting the attacker has not already been in.
Organizations running unsupported PHP versions face the hardest path. There is no patch for 8.1 or earlier, so the choice is an upgrade or a shutdown. That is a difficult business decision as much as a security one, and it rarely gets made in a week.
The longer tail
The php2shell episode will not end with patching. Compromised servers that were not patched in time will show up in incident reports for months, and the KEV listing ensures the flaw stays on every defender's radar. The real test is whether organizations that took systems offline actually bring them back patched, or quietly turn them back on unchanged once the headlines fade.
History suggests the second outcome is common. After major PHP flaws in 2019 and 2024, internet-wide scans still found large populations of unpatched hosts weeks later. The pattern repeats because the people running the systems are rarely the people who read CISA alerts. Hosting providers, freelance developers and small agencies inherit patching responsibility without the tooling to track it.
There is also a quieter risk. Attackers who gain code execution through php2shell do not always deploy noisy ransomware. Many plant web shells and wait, harvesting credentials and data over months. By the time a breach surfaces, the initial flaw is long patched and the trail is cold. That is why CISA's monitoring guidance, the SIGMA rule and the watch for shell-spawning PHP workers, matters as much as the patch itself.
For more on the agency's guidance, see the CISA alert on critical PHP vulnerabilities. Related coverage lives in our cybersecurity section.