Websites belonging to UK councils, the Metropolitan Police and governments across Europe went dark on Wednesday after the disclosure of two critical flaws in PHP, the code behind most of the internet.
In the UK, the sites reported unavailable included those of Edinburgh and Oxford councils and the Met Police. Error messages also appeared on the Bristol, Lambeth and Barnet council websites.
The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and have been nicknamed “PHP2Shell”. They can let an attacker take control of a web server without logging in. Both are rated 9.2 out of 10 for severity.
PHP’s developers released emergency fixes at around 3pm UK time on Wednesday, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are available from php.net. Details of the flaws had leaked online before the planned disclosure date.
Britain’s National Cyber Security Centre has issued an alert telling organisations to update immediately. If they can’t, they should apply temporary fixes published by PHP’s developers. If those can’t be put in place quickly either, the NCSC says organisations should consider taking affected systems offline. CERT-EU, the EU’s cyber emergency team, has given similar advice.
Cloudflare’s chief technology officer, Dane Knecht, said before the fixes landed that the firm was seeing early attacks. He told site owners to treat its emergency firewall rules as a “STOPGAP only”.
No successful break-ins had been confirmed as of Wednesday afternoon. Security specialists expect attack attempts to increase now that the fix is public, because attackers can use the patch to pinpoint the weakness and then target servers that haven’t been updated.
Read next: Insurers know a mega cyber-loss is coming. So why is capacity still growing?
The Netherlands saw the most disruption. The Dutch National Cyber Security Centre took its own site offline as a precaution, as did the following:
Elsewhere in Europe:
According to W3Techs, PHP runs around 70% of websites whose server-side language can be identified. Palo Alto Networks’ Unit 42 has counted more than 22.6 million internet-facing systems that could be vulnerable. Security firm Wiz called the bugs among the most severe ever found in PHP.
Official fixed releases cover only PHP 8.2 to 8.5. Sites on older, unsupported versions have no simple update to install. One scan of the top 15 million websites found that nearly half of the PHP sites showing their version number were running these older releases.
PHP2Shell is close to the scenario cyber underwriters have long modelled: one piece of shared software that leaves thousands of policyholders exposed at once. It comes as shared technology dependencies push aggregation up the underwriting agenda. The market is also soft: DUAL says international rates are down 43% since late 2023.
Brokers can expect questions in four areas:
Precautionary shutdowns. Will business interruption cover respond when a client took its own site offline without a breach? That depends on the policy wording and the waiting period.
Read next: Revealed - what’s changing about cyber claims
Clients should do four things:
Insurance Business will update this story as it develops.
