Two vulnerabilities in PHP, the language that underpins the majority of the public web, have taken government services across Europe offline in the largest coordinated precautionary withdrawal of public-facing systems since the Log4Shell episode.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, are rated 9.2 on the CVSS severity scale. Both allow unauthenticated attackers to execute code on vulnerable servers. CERT-EU's assessment is that they affect every PHP release going back to PHP 5, first shipped in 2004.
The PHP Foundation published emergency fixes on Wednesday, October 21, with a blunt instruction to update immediately.
The count in Westminster
Britain supplied the first hard numbers. In the House of Lords on Thursday, technology minister Baroness Lloyd of Effra told peers: "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable."
She attributed the disruption largely to precautionary measures taken while updates and mitigations were applied, and said departments were being helped to restore services safely. Whitehall has not published a list. Among those known to have taken systems down is the Office for Budget Responsibility — inconveniently, with next week's Budget approaching. Peers raised reports of disruption at the DVLA and in police services. Lloyd said the government had stood up a cross-departmental incident response operation before public disclosure, and that the National Cyber Security Centre had issued 50,000 warnings to businesses and other organisations.
She also said the government was not aware of any confirmed compromise of central government systems, later extending that assessment to the wider UK public sector. Councils reported to have taken services offline included Edinburgh, Oxford, Bristol, Lambeth and Barnet.
A continent offline
The withdrawals were not confined to Britain. The Netherlands took DigiD — its national login system for government services — offline on October 21, along with the records portal MijnOverheid. The Port of Rotterdam, the football association KNVB, the country's five largest political parties and a number of hospitals went dark alongside them. Belgium's foreign ministry, Finland, France and Germany followed; Germany's digital ministry pointed to ITZBund, the federal IT service provider, which pulled several sites. The Czech government took its main site offline at 7pm local time on the cyber watchdog's recommendation.
The pattern across jurisdictions was consistent: where a service could not be patched inside the window, it was removed from the internet instead.
Four days of warning
The most troubling element is timing. AWS analysts say at least one actor began exploiting the flaws on October 17 — four days before the patches shipped. Cloudflare's WAF rules for the flaws took effect at 03:02 UTC on October 21; the PHP fixes followed around 13:30 UTC that day, according to CERT-EU. The NSA and CERT-EU issued advisories the same day.
That leaves an interval in which defenders did not know the bug existed and attackers did. It is not yet established what, if anything, was taken during it.
The AI connection
Both vulnerabilities were surfaced by AI-assisted audits, and the attribution is worth stating precisely rather than loosely.
The security firm Calif identified one of the two flaws using OpenAI's GPT-5.6 Sol, as part of OpenAI's Patch the Planet initiative — a programme run with Trail of Bits to help open-source maintainers find and fix vulnerabilities. Google's Wiz independently discovered and reported both flaws with the help of AI tooling. OpenAI subsequently investigated the vulnerabilities itself and worked with vendors and government agencies on coordinated disclosure.
The sequence matters for how this is read. Frontier models did not merely generate plausible-looking bug reports, of which maintainers already receive an unmanageable volume. They produced findings that a commercial security firm validated, that a second firm independently corroborated, and that were then patched upstream and disclosed under coordination with national agencies within days. That is the workflow the vendors have been promising. It arrived attached to a nine-out-of-ten severity rating.
What administrators should do
The operational advice is unglamorous and the same everywhere: if a server is internet-facing, runs an affected PHP version, and was unpatched on or after October 21, assume it was probed. Apply the October 21 fix where a supported branch allows it, after testing. Where a system cannot be patched, taking it offline is the only measure that removes the exposure outright — which is precisely the trade a dozen governments made this week.
The deeper lesson concerns dependency, not PHP. A language running somewhere near seventy percent of websites — a figure widely repeated, though the method behind it is not stated — has a maintenance burden that does not scale with its importance. Two flaws in a twenty-year-old codebase can suspend the digital front door of a state for a week. The patching was fast. The exposure was not new.