THE SHORT VERSION
● Six countries pulled sites — Netherlands, Finland, France, Denmark, Germany, UK
● 22.6 million systems — internet-facing and potentially exposed, per Unit 42
● Patched 21 Oct, ~3pm UK — PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
● NCSC step three — if you cannot patch or mitigate quickly, take it offline
CVE-2026-109618 and CVE-2026-109619 — nicknamed php2shell, both rated 9.2 — were patched on Wednesday 21 October at around 3pm UK time. What makes this incident unusual is not the bug but the response in the hours before the fix landed: national agencies decided switching public services off was the lower risk. The Netherlands saw the most disruption, with the Dutch NCSC's own website, DigiD, MijnOverheid, the House of Representatives, the Port of Rotterdam, the KNVB and several hospitals all going dark. Finland's Valtori took government public network services offline, France's Interior Ministry suspended local administration sites, Denmark's Kombit shut down the national school communication platform, and Germany's ITZBund took several sites down. In the UK the Metropolitan Police site went unavailable alongside Edinburgh and Oxford councils, with Bristol, Lambeth and Barnet returning errors.
The NCSC's guidance ran in three steps, and the third explains the blackouts: update immediately; if you cannot update, apply PHP's temporary measures; if you cannot apply those quickly, consider taking affected systems offline. CERT-EU gave materially the same advice. When a national cyber authority puts "switch it off" in writing as step three, it has concluded the mitigations are not a safe resting place — which is exactly what PHP itself said when publishing them. Palo Alto Networks' Unit 42 counted more than 22.6 million internet-facing systems potentially vulnerable, against W3Techs data putting PHP behind roughly 70% of websites whose server-side language is known.
No successful break-ins had been confirmed as of Wednesday afternoon, though Cloudflare CTO Dane Knecht said the company was already seeing early attacks and told site owners to treat Cloudflare's emergency firewall rules as "STOPGAP only." The figure that will still matter in a month: a scan of the top 15 million websites found nearly half of PHP sites disclosing their version were on unsupported releases, which get minimal source backports and no binary builds. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart the PHP service — the second CVE depends on state surviving inside a worker process.
Sources
PHP.net security advisory · Insurance Business UK · Huntress · Computer Weekly