PHP Security Breach Forces Global Website Outages
Critical PHP flaw triggers site shutdowns worldwide.
Key facts
- BSI issued a warning on 21 Oct 2026 for PHP flaws CVE-2026-109618 and CVE-2026-109619.
- The flaws, named PHP2Shell, allow remote code execution (running code on a server).
- Many sites, including the German BKA and Berlin.de, were taken offline.
- Updated PHP versions were released by the PHP project on 22 Oct 2026.
- Several services, such as S-Bahn Berlin and German state portals, returned online after patches.
On 21 October 2026, the German Federal Office for Information Security (BSI) issued a cybersecurity warning. It identified two critical vulnerabilities in PHP, catalogued as CVE-2026-109618 and CVE-2026-109619. The BSI rated the risk as level 3, Orange, indicating an exceptionally high threat. The warning urged immediate security updates.
The vulnerabilities, dubbed PHP2Shell, enable attackers to execute code remotely without authentication. As a result, many websites were proactively shut down. The German Federal Criminal Police Office (BKA) site remained offline in the morning. Other sites, such as Berlin.de, faced temporary restrictions.
The PHP development team released patched versions on 22 October 2026. After applying the updates, several services resumed operation. The S-Bahn Berlin website was reported online again by nightfall. German state portals in Rheinland-Pfalz and Saarland also reopened after the patches.
China’s Ministry of Industry called for a comprehensive review of IT systems and urged users to upgrade to the latest PHP version. South Korea’s National Security Office convened a cyber‑security crisis meeting. Finland’s state IT centre noted that public government web services were affected.
Context
PHP is a programming language that powers many websites, including blogs, news portals, e‑commerce sites, and content‑management systems. The flaw affected an estimated 400–500 million sites that use PHP, according to IT professionals.
How outlets headlined it
How this was made
Compiled by our AI newsroom from 2 independent outlets, checked by a separate AI editor against the sources. Only claims found in the sources are reported. Spot an error? Every source is linked below.
Correction or source request? simoneggert16@gmail.com
Open reader debate: Factual contributions and additions are synchronized directly in real time across all readers.
Loading contributions from cloud server…
Reader Discussion & Community Notes