Government websites across Europe go offline over critical PHP flaws

Government websites across Europe were taken offline as a precaution on October 21 after two critical PHP vulnerabilities left servers exposed to attacks.

Dutch government portals and parliamentary websites were among the services affected, alongside government web services in Finland and local administrative websites in France, Reuters reported. The Netherlands’ cybersecurity agency also temporarily shut down its own website.

The shutdowns followed the PHP security warning we covered earlier today. PHP runs behind websites built with WordPress, Drupal, Joomla and Magento, processing requests and communicating with databases. The flaws affect that underlying software, creating a risk across many different websites and services.

Attackers could exploit errors in how PHP handles memory by sending specially crafted requests to a vulnerable server. This could let them run malicious code without logging in, potentially exposing data or disrupting services.

Cloudflare said it had observed attack traffic targeting its customers, with attackers changing their requests to try to bypass protections. The company deployed firewall rules for free and paid customers but warned that those defenses do not replace a PHP update.

Emergency patches are now available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, which the PHP team rated 9.2 out of 10 in its advance warning.

Restoring services safely requires fixing PHP on the servers that run them. Updating website plugins alone will not resolve the problem, and hosting providers must apply the patches where they manage PHP for customers. CERT-EU advises considering temporary isolation of vulnerable applications from the internet when an immediate fix is not possible.