Sites named in outage reports
Statuses update when you load the page. Some of these organisations took their sites offline on purpose as a precaution.
Large PHP-powered services we're watching
What happened
On 21 October 2026, organisations across Europe started taking websites offline after warnings about two critical vulnerabilities in PHP, the programming language behind a large share of the web. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are each rated 9.2 out of 10 on the CVSS v4.0 scale. Security bodies say they can allow remote code execution, meaning an attacker could run their own code on a vulnerable server.
The PHP project scheduled a security release for 21 October 2026 at 14:00 UTC (15:00 UK time). CERT-EU urged organisations to prepare to patch immediately, and said those unable to should consider taking affected sites offline. Reports describe all versions from PHP 5 onwards as potentially affected, though PHP itself had not confirmed the full range at the time of writing.
Which sites went offline
Reported examples include the Dutch House of Representatives (Tweede Kamer), the MijnOverheid and DigiD government services in the Netherlands, the Belgian school platform Smartschool, AZ Monica hospital in Antwerp, the bookmarking site Pinboard and some parts of Wikipedia, as well as several Belgian media sites and government services in Finland. Many of these were precautionary takedowns rather than attacks.
Was the site hacked?
Not necessarily. Most of the outages reported on 21 October were sites taken offline deliberately until the patch was installed. Reports on active exploitation differed: Cloudflare said it was seeing early attacks emerging, while Australia's Cyber Security Centre said it was not aware of active exploitation at the time.
What site owners should do
- Update PHP to the patched release for your branch as soon as php.net publishes it. Security researchers expect 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but confirm the numbers in the official announcement.
- Plan an upgrade if you're on PHP 8.1 or older. Those branches are past end of life and should not be assumed to get a fix.
- Ask your host whether it is patching shared and managed servers for you, and when.
- If you can't patch yet, follow CERT-EU's advice and consider taking exposed sites offline until you can.
Is it down for you?
If a site you need isn't loading, check it with our website checker to see whether it's down for everyone or just you.
Sources
- NBC News: Critical vulnerabilities in PHP spark rush to update systems
- RTÉ: EU cybersecurity agency in warning on PHP vulnerabilities
- Brussels Times: Major websites go offline as critical PHP vulnerability triggers security fears
- NL Times: Dutch parliament website taken offline
- Tenable: PHP2Shell frequently asked questions
- PHP.net news archive (official announcements)
Questions
Is the whole internet down because of the PHP vulnerability?
No. PHP runs a large share of websites (estimates in news reports range from about 70% to 75%), but having PHP is not the same as being down. Most large services stayed online. The outages on 21 October 2026 were mostly sites that organisations took offline on purpose as a precaution until they could install the fix.
What are CVE-2026-109618 and CVE-2026-109619?
They are two critical vulnerabilities in PHP, nicknamed PHP2Shell, each rated 9.2 on the CVSS v4.0 scale. Security bodies describe them as allowing remote code execution, meaning an attacker could run their own code on an affected server.
When is the PHP patch released?
The PHP project scheduled its security release for 21 October 2026 at 14:00 UTC (15:00 UK time), and said it could release earlier if details became public. Check php.net for the official announcement and version numbers.
Why is a government or school site I use offline?
European and national cybersecurity agencies advised organisations that could not patch straight away to consider taking affected sites offline. Many public-sector sites did this as a precaution, so they may come back once the patch is installed.
How does this page know whether a site is down?
Our servers check each site every 5 minutes. A site counts as down if it does not respond, times out or returns a server error (5xx). A site that shows a maintenance message with a normal response can still appear as up.