Sites that went offline because of PHP2Shell, the October 2026 PHP remote code execution flaws CVE-2026-109618 and CVE-2026-109619, and when they came back.
On 21 October 2026 at 14:00 UTC, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical flaws that allow unauthenticated remote code execution:
- CVE-2026-109618, RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w)
- CVE-2026-109619, RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
PHP says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php. PHP 8.1 and older get no official update, but the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1.
The PHP project announced the release on 20 October. The embargo leaked a day early and exploit claims spread on social media. PHP’s advisory lists temporary settings changes that reduce exposure, but says only updating fixes the flaws. Cloudflare reported early attacks and deployed stopgap firewall rules.
CERT-EU, the cybersecurity team for the EU institutions, advised organizations that cannot patch at once to take internet-facing PHP applications off the network until a fix ships. Many operators did not wait for the patch. They took their PHP services offline. This page lists those sites, when a public source first reported them dark, and when they came back.
Background: The PHPocalypse is the second biggest story today. For detection and mitigation material, and lists of software that bundles PHP, see the Dutch NCSC’s php2shell repository.
Automated tracking stopped on 23 October 2026. On 25 October we added 124 sites from the phpvulnerabilities.app outage list, which built on this tracker’s data. Their times are as listed there. This tracker checked the ones still listed as dark on 25, 26 and 27 October, and marked the ones that had recovered as back. Pull requests that correct or expand the record are still welcome.