Authorities issued unusually broad warnings on Wednesday, October 21, 2026, about the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as php2shell. The PHP developers published an urgent security notice. The scale of the warnings has drawn comparisons with Heartbleed and Bash's Shellshock.

The German Federal Office for Information Security, BSI, advised organizations to take affected websites offline until packages were available. CISA supported that recommendation. Government websites in Denmark and Finland were taken offline, according to Reuters, which reported the same measure in France and the Netherlands. In Germany, Charité removed its entire website. Parts of berlin.de were disabled, the Freie Universität Berlin restricted IT services, and the Berlin police Internetwache was unreachable, according to dpa. Government and police websites in Bavaria and Lower Saxony were affected as well. NDR reported that some sites in northern Germany had returned.

Security specialists recorded extensive exploit traffic from Wednesday onward. Cloudflare told Reuters that it had seen millions of attempts, starting about ten hours before the vulnerability details were published at 16:00 local time. Amazon described broad exploitation in the wild and said its threat-intelligence team had observed attempts four days before the disclosure. Amazon does not know how the attackers obtained information about the exploit. A separate file-upload vulnerability may have been involved. No successful compromises had been reported at the time of publication.

Updated packages became available gradually on Wednesday evening. Debian published packages after 21:00. Fedora and Gentoo followed that evening, as did Ubuntu and Red Hat. Slackware provided packages shortly before the report, and SUSE had only recently released updated packages. Administrators should install the available updates promptly and check systems that may run PHP without their operators realizing it. PHP can arrive as a dependency on Raspberry Pi and other single-board computers used as small servers. The report raises the possibility that website shutdowns could become a more common defensive measure if AI-assisted vulnerability discovery continues to produce serious findings.