Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of two critical vulnerabilities in PHP, the widely used programming language that underpins large parts of the internet, Reuters reported. Government agencies in the Netherlands and Finland were among those that took sites offline as a precaution while website operators scrambled to protect their systems.

The PHP developers said on Tuesday that they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix was released, Reuters reported. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity, and are being called “PHP2Shell” by security researchers, according to Patchstack, a WordPress security firm tracking the emergency. Security firm watchTowr confirmed the vulnerabilities were real and said it had reproduced one of them, Patchstack said.

The shutdowns spread quickly. Dutch broadcaster NOS reported that DigiD, MijnOverheid, the website of the Dutch House of Representatives, the technology site Tweakers and the Dutch National Cyber Security Centre's own website were among those offline, Patchstack said. In Finland, the state IT centre Valtori began pulling public-sector websites offline as a precaution; it said it had found no sign of actual exploitation and that the outages were not the result of a breach, according to reporting by Bloomberg cited by Startup Fortune. Sweden's CERT-SE urged organisations to update affected systems as soon as possible or temporarily disconnect them, warning that tens of millions of websites could be at risk, SVT reported via The Daily Northern.

There were already signs of attacks. Dane Knecht, chief technology officer of the web and cloud security firm Cloudflare, said attacks were emerging and that Cloudflare was updating its firewall rules as a stopgap measure. “This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X, in remarks quoted by Reuters. The cybersecurity company Huntress said in a blog post quoted by Reuters: “PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood.”

An emergency PHP security release was scheduled for Wednesday, October 21, at 14:00 UTC, with full technical details and the list of affected versions due alongside it, Patchstack said, and CERT-EU issued its own advisory on the flaws. Wordfence, a security plugin that protects WordPress websites, warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites, Reuters reported. For the millions of small businesses, news sites and community organisations that run on PHP-based tools — including many Punjabi and diaspora websites — the message from security agencies is the same: patch immediately, or take the site offline until you can.

Sources: Reuters, October 21; Patchstack security alert, October 21; Bloomberg reporting via Startup Fortune, October 21; SVT reporting via The Daily Northern, October 21.