This story is developing and will be updated.
Websites across the US and Europe have gone offline earlier today after the disclosure of two critical flaws in PHP, the code behind most of the internet.
Sites that went offline or were partly offline included parts of Wikipedia, a number of European government sites, the bookmarking service Pinboard, and the forums 4chan and Something Awful, each waiting for a fix. The Wikimedia Foundation, which runs Wikipedia, said it was working to address the vulnerabilities.
The bugs are tracked as CVE-2026-109618 and CVE-2026-109619 and have been nicknamed “PHP2Shell”. They can let an attacker take control of a web server without logging in. Both are rated 9.2 out of 10 for severity.
PHP’s developers released emergency fixes at around 10 a.m. ET on Oct. 21, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They are available from php.net. Details of the flaws leaked online before the planned disclosure date, so attackers learned about them at the same time as defenders.
PHP is the behind-the-scenes code that builds a web page each time someone visits it. It pulls information such as product listings, account details or login screens from a database and sends the finished page to the browser. It is free, maintained largely by volunteers, and underpins WordPress, Drupal, Magento and many hosting control panels. The PHP2Shell flaws sit in PHP itself, so a website can be at risk even if its own code has no bugs.
The National Security Agency issued an advisory telling all organizations using PHP to prepare to update. It warned that the flaws “often provide a direct path to the server’s file system or database”. Where an immediate update isn’t possible, the agency recommends taking the system offline until the problem is fully fixed. Cyber agencies across Europe gave the same advice.
Before the fixes landed, Cloudflare’s chief technology officer, Dane Knecht, said the web security company was seeing early attacks. He told site owners to treat its emergency firewall rules as a “STOPGAP only”.
No successful break-ins had been confirmed as of Wednesday afternoon. The vulnerability records kept by CISA, the federal government’s cyber defense agency, showed no observed exploitation. Security specialists expect attack attempts to increase now that the fix is public, because attackers can use the patch to pinpoint the weakness and then target servers that haven’t been updated.
Read next: Cyber’s soft market is masking a coverage squeeze
According to web technology tracker W3Techs, PHP runs around 70% of websites whose server-side language can be identified. Security firm CyCognito found that the US accounts for close to half of the internet-facing systems it observed running PHP.
Official fixed releases cover only PHP 8.2 to 8.5. Sites on older, unsupported versions have no simple update to install.
Google-owned security firm Wiz called the bugs “among the most severe vulnerabilities discovered in PHP”. It said the flaws had gone unnoticed for decades and that AI tools had greatly reduced the effort needed to turn them into a working attack.
Europe was also hit hard. Government agencies in the Netherlands, Finland, France, Denmark and Germany took sites offline as a precaution, as did the Dutch national cyber agency.
Read next: Dimon says AI cyber risk is up tenfold. Cyber insurance prices are still falling
This is the second “2Shell” scare in three months. In July, two chained flaws in WordPress, dubbed WP2Shell, allowed attackers to take over sites without logging in. Coalition said it warned affected policyholders 24 hours before it saw attacks begin. Carriers with similar scanning tools will be running the same exercise this week.
The difference with PHP2Shell is scale. It sits underneath WordPress and much of the rest of the web, which makes it close to the shared-software event that underwriters have long modeled.
It also arrives in a soft market. Marsh says US cyber rates fell another 2% in the second quarter of 2026 and have been falling since mid-2023. Marsh also lists third-party software and vendor risk among insurers’ leading concerns. Industry experts are already debating whether the soft market is about to harden.
Brokers can expect questions in five areas:
Clients should do five things:
Insurance Business will update this story as it develops.
Read next: Cyber rates keep falling – but how much lower can they go?
For the carriers brokers rate highest for cyber, see Insurance Business America’s 5-Star Cyber 2026 report.
