A critical vulnerability in the PHP web programming language has caused disruption across the Internet, with numerous websites taken offline or placed into restricted modes to protect customers from potential data theft and remote code execution attacks.
PHP runs in the background of around 70 percent of websites, according to Cloudflare, underpinning major platforms such as WordPress, Magento, Drupal, Joomla, Laravel-based applications, and range of custom web services. It helps process customer actions such as logins, forms, searches, bookings and purchases. If PHP is vulnerable, the customer-facing services built on it can be exposed to disruption or attack.
The incident, dubbed the “PHPocalypse” by some software and cybersecurity engineers, has turned a deep technical vulnerability into a visible customer experience issues.
Government Agencies Warned Organisations to Suspend Services
The two remote code execution flaws were announced on October 20 and a patch release scheduled for 14:00 GMT on October 21. The emergency response was complicated by an apparent leak ahead of the official release date. Network services firm Cloudflare stated:
“Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections.”
Visitors to affected sites have encountered downtime, paused services, read-only modes, delayed deployments, and unavailable digital experiences as operators chose to go dark rather than risk exploitation.
A public PHPocalypse Tracker created by Luka Kladarić, a software engineer in Zagreb, listed sites that went offline, as the U.K. National Cyber Security Centre, the US National Security Agency and the Japanese National Cyber Coordination Office (NCO) warned organizations to temporarily suspend services such as websites until they applied the patch.
The Belgian Ministry of Foreign Affairs and the Belgian Centre for Cybersecurity took their websites down, as did several government departments in the Netherlands.
The security flaws, tracked by the PHP Foundation as CVE-2026-109618 and CVE-2026-109619 and collectively referred to by researchers as “PHP2shell,” affect the PHP runtime itself rather than a single plug-in, framework or application, making the vulnerabilities unusually broad. They can allow attackers to execute malicious code on vulnerable servers, expose customer data or disrupt services.
As PHP sits beneath so many commercial websites, public services, and ecommerce platforms, the flaws could potentially affect a number of applications across the internet.
Laravel, one of the most widely used PHP frameworks, temporarily paused deployments across Laravel Cloud regions while applying patched PHP versions to running applications. Laravel also warned that older PHP versions would not receive patches from the PHP team and urged users to upgrade.
Datadog Security Labs also warned that application-level authentication would not stop exploitation, because PHP processes the malicious request before any application code runs. The company said it had independently reproduced the flaws and confirmed that “only patching fixes these vulnerabilities,” cautioning that community workarounds do not provide protection.
