On Wednesday night, Japan’s Prime Minister posted on X about a programming language. I don’t think I have ever seen that before, and I have been in this business about ten years.
Sanae Takaichi’s message was simple: PHP has critical holes, get ready to install the fix the moment it lands, and if you can’t, temporarily switching off parts of your website is a good way to cut the risk. That is a head of government telling her country’s companies to consider taking their own websites down. On purpose.
By Thursday morning a viral post was doing the rounds in my feed, “all of this, 48 hours”, listing every breach and outage of the week. Some of it was right, some of it was stretched. So I went through the sources one by one. This is what actually happened, in as little tech as I can manage.
What broke, in simple terms
PHP is the language that quietly runs most of the web. WordPress runs on it, so do Drupal, Joomla and Magento, and a lot of government and bank websites. Reporting puts it at roughly 70% of websites.
Two holes were found in PHP itself, now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP’s own team rates both 9.2 out of 10. The scary part: an attacker does not need a password. They send the right kind of request to a vulnerable server and can, in some setups, run their own code on it.
The timeline is the reason everyone panicked:
On 17 October, Amazon’s threat team saw someone try the attack on one of its trap servers, four days before anything was public. On 20 October, details leaked ahead of the planned release, with the wrong score attached. On 21 October, PHP pushed out emergency fixes. By then, Cloudflare said it was seeing early attacks, and Amazon later said the flaw was being “broadly exploited”.
And one twist worth knowing. These bugs were found with AI. Wiz, a security firm Google owns, Calif and OpenAI all used AI models to dig up flaws that had sat in PHP’s code for more than a decade. One researcher did in about a week what would have taken a team months, according to Wiz.
Who switched off what
Most of the outages you saw were not hacks. They were people pulling the plug themselves, before an attacker could.
- In the UK, 32 government services were unavailable and four partly unavailable, a minister told the House of Lords on 22 October. The Office for Budget Responsibility took its site down. Councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet were reported hit, and the BBC took some portals offline.
- In Europe, Germany’s federal IT provider switched off several sites. French prefecture sites went down, and Orange paused some websites and apps. In the Netherlands, the Port of Rotterdam, the government portal, the football association, major political parties and several hospitals went offline as a precaution. Finland, Belgium and the Czech Republic did the same with government sites.
- In Japan, Mizuho and Shizuoka Bank paused services, MUFG and the airline ANA suspended some web services, JR West and Keihan pulled pages, and the National Tax Agency took a service down.
- Elsewhere, the Wikimedia Foundation took several systems down as a precaution. The Internet Archive went into emergency maintenance and is reported back online. Australia’s own cyber security agency took its website offline, which I found a little funny and also completely right. Canada warned that some government sites might be unavailable.
That is a lot of very serious organisations choosing a dead website over a risky one.
How governments handled it
Here is where it got interesting, because the advice was blunt.
In the US, the FBI said that if you can’t update straight away, “take the system offline until it can be fully mitigated”. The NSA told organisations to patch or disconnect. In Europe, ENISA and CERT-EU said patch now, and if you can’t, think about cutting the system off from the internet. The UK’s National Cyber Security Centre sent 50,000 warnings to businesses and organisations.
Japan’s approach came from the very top, with the Prime Minister’s post and a matching call from the National Cybersecurity Office. And the Japanese Bankers Association made a point of saying interbank payments were not affected, which is the sort of calm, specific update I wish more organisations gave.
One honest note. At the time of release, PHP’s team said it had not found a working exploit, and researchers at watchTowr found many of the public attack scripts crash or do nothing. Amazon and Cloudflare, who see a huge share of web traffic, say attempts are real and growing. Both things can be true. A lot of attempts, few clean break-ins so far, and nobody wanting to be the first big one.
Where the noise goes wrong
The viral posts were mostly in the right direction, but a few details drifted. The “broadly exploited” line I could trace to Amazon, not to the magazine it was credited to. The 69% figure is closer to 70% in most reporting. Some of the ministries named, I couldn’t confirm at all.
I don’t say this to dunk on anyone. In a week like this, details get copied faster than they get checked, and decisions get made on screenshots. If you run a business, act on the advisory from your host or your government, not on the most shared post.
The other thing the noise misses: a website being offline is not the same as a website being hacked. Most of those organisations were down because they were careful.
What I take from it
The organisations that came out of this well were not the ones with the fanciest security. They were the ones that knew three things on Wednesday night: which of their sites ran PHP, who was responsible for updating it, and who was allowed to switch a site off.
That last one matters more than it sounds. In a lot of companies, nobody is sure who can take the website down without three approvals and a meeting. On 21 October, the organisations that could decide in an hour did better than the ones that needed a day.
If you are not sure which version of PHP your own site runs, or who patches it, that is the first thing I’d find out this week. Our companion post covers WordPress and what hosts like Hostinger and GoDaddy actually did, and if you build apps with AI, our security checks before launch cover the rest. And if you’d like a second pair of eyes, our free 30-minute growth audit includes a quick look at your site setup. We have helped 150+ businesses, and if you are already fine, we will tell you that.
FAQ
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in the PHP programming language, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 by PHP’s own team. They can let an attacker run code on a vulnerable server without logging in. PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why did so many websites go offline?
Mostly as a precaution. Agencies including the FBI and Europe’s cyber security bodies advised that anyone who could not patch straight away should take affected systems offline. Governments, banks, transport companies and Wikimedia chose to switch sites off for a few hours rather than risk a break-in while they installed the fix.
Was my data stolen?
Being offline does not mean a site was breached, and most organisations said they saw no attack. The risk sits with the website’s server, where an attacker could steal data or plant something harmful. As a visitor, watch for odd pages, unexpected downloads or repeated login prompts, and leave any familiar site that suddenly looks wrong.
Sources
- PHP2Shell FAQ, versions and exploitation timeline, Tenable
- PHP2Shell puts dozens of UK government services out of service, The Register, 22 October 2026
- Japan PM warns of vulnerabilities in PHP, Nippon.com (Jiji), 21 October 2026
- Factbox: websites taken offline over PHP risks, Global Banking and Finance Review
- PHP vulnerability 2026: websites shut down globally, ABC7 (citing CNN)
- What is PHP, the programming language that forced government websites offline, ProtoThema, 22 October 2026 (FBI guidance)
- Emergency response in Japan’s finance and rail sectors, BigGo Finance (Japanese Bankers Association statement)
- PHP2Shell: why many websites had to go offline, Malwarebytes, 22 October 2026
Last updated: 23 October 2026.