PHP2Shell Flaw Triggers Global Scramble as Governments Pull Websites Offline

Cybersecurity companies report millions of attempts to exploit a newly discovered flaw in PHP, the programming language behind about 70% of the world’s websites. The US National Security Agency warned that the weakness could let attackers take control of web servers, steal sensitive data, disrupt services and move deeper into a network. The problem emerged on Wednesday and pushed governments and companies to pull their sites offline before attackers could strike.

The flaws, known collectively as “php2shell,” are tracked as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they could let attackers execute malicious code on vulnerable servers without authentication. That access could expose sensitive data, enable unauthorized entry and interrupt digital services.

Governments and Companies Pull Services Offline

The disruption has spread across several countries. Affected services include the Netherlands’ DigiD digital identity platform, government websites in Finland, France and Germany, parts of Wikipedia, and some online services run by Japan’s Mitsubishi UFJ Financial Group. Many government sites came back online soon after officials installed the patch.

In the UK, 32 government services went offline, according to cybersecurity minister Liz Lloyd. She told parliament that the outages mostly reflected caution while teams applied updates.

Lloyd said the shutdowns “largely resulted from precautionary measures” while updates were applied.

Downing Street said no public-facing critical services suffered an impact. It added that “some limited services may be temporarily offline,” but stressed that this did not mean hackers had breached them. The website for the BBC’s Traitors was among the sites that went down on Thursday.

The outages raised particular concern about schools, local governments and charities. These organizations often lack dedicated cybersecurity support, so they may struggle to apply the fix quickly.

Attack Attempts Climb Into the Millions

The scale of hostile activity grew fast. Matthew Prince, chief executive of Cloudflare, said in a post on X that his company detected thousands of exploitation attempts in the 10 hours before public disclosure. The figure jumped to tens of thousands within 45 minutes of the announcement.

Prince said attempts rose to “hundreds of thousands within two hours, and millions now.”

Cloudflare deployed web application firewall protections around nine hours before the public disclosure. The company said customers using its firewall services received those protections automatically. Amazon Threat Intelligence added that PHP2Shell was “now being broadly exploited in the wild.”

Not everyone agrees the threat has fully materialized. Ryan Austin, a researcher at the cybersecurity company Calif who helped discover the flaw, offered a more measured view.

“At the moment it doesn’t look like exploitation has taken off or been widespread,” said Ryan Austin.

Why PHP Matters So Much

Most people have never heard of PHP, yet they probably interact with it daily. The name stands for PHP: Hypertext Preprocessor, an open-source, back-end language that runs on a web server. Developers created it in the early 1990s to serve dynamic web pages and applications. When you visit a site built on PHP, the code collects data and turns it into a page you can read.

The language still powers major platforms, including Wikipedia, online shops and WordPress. Popular frameworks such as Laravel, Symfony and Drupal also rely on it. A non-profit called the PHP Foundation maintains the language, and its members include individuals and companies that depend on it.

Security firms Wiz and Calif said the flaws sit inside the language itself, and versions released over the last decade carry them. Austin told the BBC it was “the most serious vulnerability I’ve ever found.” Former National Cyber Security Centre chief executive Ciaran Martin called the flaw “very bad.”

Martin said that while most internet software vulnerabilities didn’t matter, this was “the most serious vulnerability discovered for five years.”

AI Found the Flaws, and a Process Failed

The discovery carries another distinction: artificial intelligence helped bring the flaws to light after they went undetected for more than a decade. Wiz described them as the “most severe” ever detected by AI. OpenAI, whose technology researchers used to find the problems, called the discovery “one of the most impactful security issues in recent memory.”

The disclosure also exposed trouble inside the project that maintains PHP. The PHP Foundation acknowledged that delays in addressing the problem revealed a serious weakness in its security response. It described the stalled process as a “structural failure.”

What Website Operators Need to Do

Governments and security agencies have urged website operators to install the new emergency fix or consider taking their platforms offline. The vulnerabilities affect PHP’s underlying runtime, so updating website code or individual plugins alone will not solve the problem. Administrators must update the PHP software running their applications, or contact their hosting providers to confirm the fixes are in place.

Not every website faces the same exposure. Systems that do not run PHP on their own servers may avoid the problem, and so may those whose operators can install the security updates promptly. Those operators may keep their sites online without the same disruption.

For now, the race between defenders and attackers continues. Officials have taken thousands of services offline as a precaution, while attackers keep probing for unpatched servers. The biggest risks sit with smaller organizations that lack the resources to patch fast, and they will determine how far the damage spreads.