Government websites disappeared. Online services became unavailable. Across France and several other European countries, visitors suddenly found themselves facing maintenance messages instead of the pages they expected.
For anyone watching from the outside, it looked like the aftermath of a coordinated cyberattack. The reality was different — and potentially much more serious.
On October 21, 2026, organizations around the world began taking websites offline after the disclosure of two critical security vulnerabilities in PHP, one of the programming languages that quietly powers much of the modern web. The flaws could allow attackers to execute malicious code on vulnerable servers, potentially gaining access to systems and sensitive information without needing a password.
The shutdowns were largely precautionary. Rather than waiting for attackers to exploit the weaknesses, administrators temporarily disconnected exposed services while emergency security patches were deployed.
The distinction matters: a website going offline does not necessarily mean it has been hacked. But the scale of the response illustrates how a problem in a single widely used technology can put an enormous part of the internet on alert.
Sommaire
- What happened to websites on October 21 and 22?
- What are the two critical PHP vulnerabilities?
- Why were government websites taken offline?
- Are WordPress websites affected?
- Was this actually a massive cyberattack?
- What should website owners do now?
- What this incident reveals about internet security
- What to Remember (FAQ)
What happened to websites on October 21 and 22?
The emergency began on October 20, when the PHP development team warned that two critical vulnerabilities had been identified and that urgent security updates were being prepared.
The announcement immediately attracted the attention of cybersecurity agencies and hosting providers. PHP is not an obscure piece of software running on a handful of specialized machines. It is a central component of countless websites, online stores, publishing platforms and public services.
On October 21, the situation became visible to ordinary internet users.
In France, the Ministry of the Interior placed affected websites into preventive maintenance following recommendations from the country’s cybersecurity agency, ANSSI. Several prefecture websites became inaccessible, while other public services also temporarily restricted access.
The City of Paris confirmed that some of its websites had been taken offline as a precaution while technical teams worked to deploy the necessary fixes.
Similar precautions were taken elsewhere in Europe. Governments, hospitals, businesses and other organizations temporarily suspended access to vulnerable services rather than risk exposing their infrastructure.
The PHP team released emergency patches on October 21. By October 22, French cybersecurity authorities had also confirmed the existence of proof-of-concept exploits for the two vulnerabilities on certain PHP deployments.
That development was significant. A vulnerability is a weakness that might be exploitable; a proof of concept demonstrates that exploitation can work under specific conditions. It does not, however, establish that real-world systems have already been compromised.
For administrators, the priority was clear: identify exposed systems, apply the updates and verify that services could safely return online.
What are the two critical PHP vulnerabilities?
The incident revolves around two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
Both received a critical severity score of 9.2 under the CVSS 4.0 scoring system. More importantly, both can potentially lead to remote code execution (RCE).
In plain English, remote code execution means an attacker may be able to make a server run instructions of the attacker’s choosing. Depending on the permissions available to the compromised process, this could open the door to data theft, malicious software installation, website manipulation or further attacks against connected systems.
The two PHP flaws involve different problems with memory management.
CVE-2026-109618: A problem with memory exhaustion
The first vulnerability involves what happens when PHP runs out of memory while processing certain requests.
Normally, software should handle memory exhaustion by stopping the affected operation safely. Under particular conditions, however, PHP could interrupt a request before some internal data structures had been properly initialized.
When the server subsequently attempted to clean up the failed request, it could process invalid memory data. An attacker capable of manipulating the circumstances surrounding that failure might exploit the resulting memory corruption.
The technical details are complicated, but the principle is straightforward: an error-handling mechanism designed to recover from a problem could itself become an entry point for an attack.
CVE-2026-109619: Old data surviving between requests
The second vulnerability concerns internal information that PHP sometimes retains after the memory containing it has been released.
A server may process thousands of requests using the same worker processes. Those processes must carefully reset temporary information before handling subsequent requests.
In certain circumstances, PHP could retain references to memory that was no longer valid. A later request might then access that stale information, creating another opportunity for memory corruption and potentially arbitrary code execution.
Both vulnerabilities are particularly concerning because exploitation may not require the attacker to authenticate.
According to the PHP security team, the highest demonstrated risk involves servers running PHP through Apache’s older mod_php module. In that configuration, an exploit has been demonstrated that can operate before the website’s own application code begins running.
Other PHP configurations, including PHP-FPM, are also considered potentially affected, although the availability and reliability of specific exploitation techniques can differ.
That distinction matters: not every PHP website presents exactly the same level of exposure, but administrators cannot safely assume their configuration is immune.
Why were government websites taken offline?
A temporary shutdown might seem like an extreme response to a software vulnerability. For public institutions managing sensitive information and essential services, however, the calculation is relatively simple.
Keeping a vulnerable service online preserves access for visitors, but it may also preserve access for attackers.
Taking it offline interrupts legitimate users, yet gives administrators time to install security fixes, inspect configurations and reduce the possibility of exploitation.
That is why the disruptions in France and elsewhere should not automatically be described as successful cyberattacks.
The City of Paris explicitly characterized its temporary closures as preventive measures. The wider emergency was driven by a serious vulnerability and the possibility of exploitation, rather than evidence that every unavailable website had been breached.
There is also an important difference between taking a website offline and shutting down an organization’s entire computer infrastructure. A public-facing website can be temporarily disabled while other internal systems continue operating.
Still, the interruptions carried real consequences. Government information became harder to access, online procedures were disrupted, and administrators faced the additional pressure of restoring services without exposing their systems to unnecessary risks.
The alternative — leaving a potentially vulnerable server publicly accessible while working out whether it was safe — could have been considerably worse.
Are WordPress websites affected?
For millions of website owners, this is probably the most important question.
Yes, WordPress websites can be affected because WordPress runs on PHP. But that does not mean every WordPress installation is vulnerable or that every owner needs to perform the same update.
The vulnerabilities were discovered in PHP itself, not specifically in the WordPress content management system.
That distinction changes where the solution must be applied.
Updating WordPress core, themes and plugins remains an essential security practice, but those updates alone do not fix vulnerabilities in the PHP interpreter running on the server.
The necessary security patch must be installed at the PHP or operating-system package level.
For customers using conventional shared hosting or managed WordPress services, that responsibility usually belongs to the hosting provider.
For example, IONOS confirmed on October 22 that it had deployed the official security updates across the hosting platforms it operates. The company also reported implementing additional protective measures before the patches became available.
Customers managing their own virtual private servers or dedicated servers, on the other hand, may need to perform the update themselves.
The distinction is important because two WordPress websites running identical versions of WordPress could have very different levels of exposure depending on their hosting environments.
An up-to-date website running on an unpatched PHP server could still be at risk. Conversely, a website whose hosting provider has already applied the necessary PHP security fixes may be protected against these particular vulnerabilities without its owner having changed anything in the WordPress dashboard.
Was this actually a massive cyberattack?
Not in the sense that the widespread shutdowns were all caused by hackers breaking into websites.
The confirmed facts establish a serious worldwide security emergency involving two exploitable vulnerabilities. They do not establish that every affected organization suffered an intrusion.
This distinction is frequently lost when cybersecurity incidents become headline news.
A vulnerability is a weakness that an attacker might exploit.
An exploit is a method of taking advantage of that weakness.
A successful cyberattack occurs when malicious activity actually compromises, disrupts or otherwise affects a target.
The existence of working demonstrations makes the danger more concrete. It does not automatically prove that stolen databases, compromised servers or widespread unauthorized access have resulted from the vulnerabilities.
There is another reason to be cautious: a website can become unavailable for many reasons, including deliberate maintenance, technical failures and genuine denial-of-service attacks. Similar symptoms do not establish a shared cause.
What made the PHP incident particularly alarming was the possibility that attackers could target a widely deployed software component rather than search for weaknesses in individual websites.
A vulnerability affecting software used across thousands of different organizations presents a potentially attractive opportunity for automated exploitation.
And once enough technical information becomes public, the interval between disclosure and attempted exploitation can become dangerously short.
What should website owners do now?
The good news is that official security fixes are available.
The PHP development team released patched versions for its supported branches on October 21:
- PHP 8.2: update to version 8.2.35 or a patched vendor equivalent.
- PHP 8.3: update to version 8.3.36 or a patched vendor equivalent.
- PHP 8.4: update to version 8.4.27 or a patched vendor equivalent.
- PHP 8.5: update to version 8.5.12 or a patched vendor equivalent.
PHP 8.1 and older branches are no longer supported directly by the PHP project. Some operating-system vendors provide their own security fixes for older versions, but site owners should verify that protection with their provider rather than assuming an outdated installation is safe.
The first step is therefore to establish who manages PHP on your website.
1. Check your hosting provider’s security announcements
If your website is hosted on a managed platform, consult its official status page or security notices.
Providers may already have installed the necessary patches, even if the PHP version displayed in your control panel has not visibly changed because of vendor-maintained security backports.
2. Verify your PHP version and patch status
Website administrators should confirm which PHP version their server uses and whether the appropriate security updates have been applied.
For WordPress, the PHP version can generally be found under Tools → Site Health → Info → Server.
However, the version number alone may not reveal whether an operating-system vendor has applied a backported patch.
If you are unsure, ask your hosting provider to confirm whether CVE-2026-109618 and CVE-2026-109619 have been addressed.
3. Update self-managed servers promptly
If you administer your own VPS, dedicated server or container infrastructure, install the relevant updates from your trusted operating-system or PHP package provider.
Check that every affected PHP runtime has been updated and that the services using it are running the corrected version.
The PHP team has also documented temporary mitigations for organizations unable to patch immediately. These can reduce exposure to particular attack paths, but they are not substitutes for applying the security updates.
4. Review suspicious activity if your server was exposed
A vulnerable system is not necessarily a compromised system.
Nevertheless, organizations that remained exposed should consider reviewing relevant server logs, security alerts and unusual activity, particularly if their configuration matched known exploitation conditions.
If there is evidence of compromise, incident-response measures may be necessary in addition to installing the patch.
For ordinary WordPress users whose hosting provider has confirmed that its infrastructure is protected, the immediate priority is usually to verify that assurance and keep the rest of the website maintained.
There is no reason to treat every maintenance notice as proof that personal information has been stolen.
What this incident reveals about internet security
The most revealing aspect of this emergency is not that PHP contained critical vulnerabilities. All sufficiently complex software can contain security flaws, including software that has been developed and scrutinized for decades.
What makes this episode significant is the extraordinary dependence of modern websites on shared infrastructure.
A government portal, an independent news website, an online store and a small business blog may have little in common from a visitor’s perspective. Behind the scenes, however, they can depend on the same programming language, libraries, hosting components and server configurations.
That creates an uncomfortable trade-off. Widely adopted technologies make the web more accessible and economical to build. Developers can reuse established tools instead of rebuilding everything from scratch.
But when a serious vulnerability appears deep inside those shared foundations, its potential consequences extend far beyond any single application.
This problem becomes even more complicated when older installations remain connected to the internet long after mainstream support has ended.
The same broader weakness appears in other areas of cybersecurity, including the growing concern surrounding automated attacks against poorly secured connected devices. Although that is a separate threat, it illustrates how outdated systems can become particularly attractive targets when attackers are able to operate at scale.
The PHP incident also demonstrates something more encouraging: coordinated defensive action can reduce exposure before a worst-case scenario unfolds.
Security teams issued warnings, developers prepared emergency patches, hosting providers deployed updates and organizations temporarily withdrew vulnerable services from public access.
Those precautions came at the cost of short-term disruption. But a few hours of downtime can be a reasonable price to pay when the alternative is potentially handing an attacker control of a critical server.
The real test now is what happens after the headlines disappear — particularly on the countless smaller websites whose owners may never realize that their security depends on software they rarely see.
What to Remember (FAQ)
Why did so many websites go offline in October 2026?
Two critical PHP vulnerabilities prompted governments, hosting providers and businesses to temporarily disable potentially exposed websites while emergency security updates were deployed.
What are CVE-2026-109618 and CVE-2026-109619?
They are critical PHP security vulnerabilities involving memory-handling problems that can potentially allow attackers to execute code remotely on affected servers.
Were French government websites hacked?
The widespread closures were primarily precautionary. A website being taken offline because of a security warning does not, by itself, indicate that hackers gained access to its systems or data.
Are WordPress websites vulnerable to the PHP flaws?
Potentially, yes. WordPress depends on PHP, so its security also depends on the version and configuration of PHP used by the hosting server. Applying the relevant PHP security fixes is essential.
Does updating WordPress fix the PHP vulnerabilities?
No. Updating WordPress core, plugins and themes does not replace a PHP security patch. PHP itself must be updated or patched by the server administrator or hosting provider.
What should I do if my website still uses PHP 7.4 or another outdated version?
Contact your hosting provider to verify whether it supplies security backports. Older PHP versions no longer receive direct support from the PHP project, so migrating to a maintained version is strongly recommended after checking application compatibility.
Sources: PHP Development Team, ANSSI / CERT-FR, CERT-EU