PHP2Shell Forces Major Websites Offline as Hacking Attempts Reach Millions

Governments, banks and major internet platforms have been forced into an extraordinary defensive position: taking their own websites offline before hackers could potentially take control.

The disruption accelerated on October 21, 2026, after two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, triggered emergency security updates. Collectively known as PHP2Shell, the flaws can allow unauthenticated attackers to execute malicious code on vulnerable web servers.

According to Reuters, Cloudflare detected thousands of exploitation attempts before public disclosure. That figure jumped to tens of thousands within 45 minutes and eventually reached millions as attackers targeted exposed infrastructure.

How Many Websites Went Offline?

An independent PHP2Shell outage tracker documented 56 affected websites and services by October 22, with 50 restored and six still listed as unavailable at its reporting cutoff. The tracker covers publicly reported incidents rather than every affected website worldwide.

The United Kingdom reported 32 government services unavailable and four partially disrupted, primarily because of precautionary security measures.

But these figures capture only part of the disruption. Website monitoring suggests the broader impact was considerably larger.

What the Downtime Data Reveals

According to UptimeRobot's October 22 analysis, downtime alerts climbed from approximately 3,300 per minute on October 20 to 37,000 per minute at the October 21 peak, an elevenfold increase.

Monitored websites unreachable by domain, October 20 versus October 21, 2026

Source: UptimeRobot. Counts represent unreachable websites in its monitored sample, not verified PHP2Shell compromises.

The Netherlands recorded one of the sharpest increases, with monitored unreachable websites rising from 4,356 to 14,682. Germany more than doubled, while Switzerland and France experienced substantial increases. Across the broader .com domain category, unreachable monitored sites increased from 99,797 to 157,224.

European monitoring locations experienced the greatest disruption. Importantly, these numbers reflect connection failures, including precautionary shutdowns and potentially unrelated incidents. They do not measure successful cyberattacks.

Major Websites and Platforms That Went Offline

The most consequential disruptions affected services people and businesses depend on for identity verification, public information, banking, transport, enterprise administration and digital content.

Sources: Reuters, Wikimedia Foundationand BambooHR status reports. The entries are reported outages, not confirmed breaches

For enterprise customers, these were more than inconvenient error pages. BambooHR's precautionary shutdown interrupted access to essential HR functions, including payroll. Government portal outages affected access to public services, while financial and transportation companies restricted selected digital operations during patching.

The economic consequences of such interruptions have not been comprehensively quantified, but the incidents illustrate how a vulnerability in underlying software can disrupt otherwise functioning business applications.

Millions of Attacks, but How Many Successful Hacks?

The critical distinction is between exploitation attempts and verified compromises.

Amazon Threat Intelligence detected an attempted PHP2Shell exploit on October 17, four days before the vulnerabilities were publicly disclosed, using its MadPot honeypot infrastructure.

However, as of October 23, no reliable global total of successfully hacked websites has been established. Major platforms that publicly reported outages have not thereby confirmed data breaches or unauthorized server access.

For companies, that uncertainty is significant. Organizations may have patched exposed systems without knowing whether an attacker attempted to compromise them before the update.

The Bigger Risk for Global Businesses

PHP underpins approximately 70% of websites, although that does not mean every installation is vulnerable. The two security flaws nonetheless expose a critical dependency shared across government infrastructure, commercial websites and enterprise applications.

The PHP development team released emergency security updates on October 21, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations operating older versions must obtain supported security backports or upgrade their systems.

The immediate priorities are identifying affected PHP installations, applying security fixes and reviewing server activity for signs of exploitation. Systems that cannot be secured promptly may need to remain offline.

PHP2Shell has already exposed a difficult reality of modern digital infrastructure: a vulnerability does not need to produce a confirmed mass breach to cause worldwide disruption.

Governments, businesses and major platforms suspended services because the alternative carried potentially greater consequences. The next phase of the crisis will depend on whether forensic investigations uncover successful intrusions among systems that remained exposed.