Critical PHP Flaws Push Governments to Take Websites Offline as NSA Urges Immediate Patching

Governments and companies around the world took websites offline this week as they rushed to patch two critical flaws in PHP, the programming language behind a large share of the internet, after the U.S. National Security Agency advised taking systems offline if they could not be updated right away, according to The Record, PCMag and the PHP Foundation.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell," can let an attacker who has no password or account run code on a server running PHP, the PHP Foundation said. PHP rated both critical, with severity scores of 9.2 out of 10, The Record reported.

PHP's maintainers issued an urgent notice on the evening of Tuesday, Oct. 20, and began releasing fixes after 10 a.m. Eastern time on Wednesday, Oct. 21, according to The Record. The PHP Foundation said the releases were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. "If you run PHP, it is imperative that you update now," the foundation said.

What the NSA and Other Agencies Said

"These vulnerabilities often provide a direct path to the server's file system or database," the NSA said, according to PCMag. If an immediate update is not feasible, the agency recommended "that organizations take the system offline."

CERT-EU, the cybersecurity service for European Union institutions, urged organizations that cannot fix the problem immediately to "consider isolating internet-facing applications from public networks until a fix can be applied," PCMag reported.

The European Union, the U.S., Germany, Japan, Australia, the U.K. and the Netherlands all issued warnings, and several governments took some websites offline before the patch was released, The Record reported. Large companies including Nintendo also took services offline while they addressed the bugs, according to The Record. Hundreds of websites were down on Wednesday, the outlet reported.

Dane Knecht, chief technology officer of Cloudflare, said the company was already seeing attacks emerging and had released stopgap protections for some customers, The Record reported.

Old Code, Older PHP Versions and AI

The flaws affect PHP versions going back to 5.4, according to the U.K.'s National Cyber Security Centre, but patches were released only for PHP 8.2 and newer, PCMag reported. "PHP 8.1 and older no longer receive updates from the PHP project," PHP's security team said, according to The Record.

Security firm Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," adding that "the vulnerable code had been present for more than a decade," according to PCMag. An artificial intelligence model from OpenAI helped uncover the flaws, PCMag and The Record reported.

In a blog post, the PHP Foundation said both flaws sit in parts of PHP "that nearly every request touches: memory management and error handling." The foundation said early signs of one of the problems were found during a 2024 security audit, but that its decision process "caused work on a fix to stall and restart repeatedly over months."

"We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation wrote. It said the security team has since started changing its processes.

Some estimates show more than 70% of all websites use PHP, The Record reported.

Image: Servers in a data center (file photo), by Victorgrigas, Wikimedia Commons, CC BY-SA 3.0.

Yossi Schmidt, Founder and Editor-in-Chief, The Digital Free Press

Hold Everyone Accountable.

Sources: The Record from Recorded Future News, "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities" (Oct. 21, 2026): https://therecord.media/php-script-vulnerabilities-warnings ; PCMag, "This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says" (Oct. 2026): https://www.pcmag.com/news/php-flaw-is-so-serious-websites-should-consider-going-offline-nsa-says ; The PHP Foundation, "Today's PHP Security Release, and How We're Strengthening PHP Security" (Oct. 21, 2026): https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/