Governments take websites offline after two critical vulnerabilities are found in PHP

International Science and Technology International Relations Science & Technology

Governments take websites offline after two critical vulnerabilities are found in PHP

22 October 2026

Authorities in Europe, Asia and other continents temporarily took some government websites offline on October 21 and 22, 2026 to protect against newly discovered security vulnerabilities in the PHP programming language, which is used by more than 70 per cent of websites. The United States National Security Agency issued a rare public warning saying that all organizations using PHP for their systems should be prepared for an update addressing two critical vulnerabilities, and advised taking websites offline if they could not be updated immediately. In Germany the Federal Ministry for Digital Transformation and Government Modernisation took some websites offline as a preventive measure, and France's Ministry of the Interior deactivated the official websites of local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic also shut down websites to apply a security patch. The pair of vulnerabilities, named PHP2Shell, were pinpointed with the help of artificial intelligence.

Share of websites using PHP: more than 70 percent of websites Name of the vulnerabilities: PHP2Shell Agency that warned: United States National Security Agency (NSA)

Why it matters for exams: It is a rare case of a software vulnerability drawing a public warning from a national signals intelligence agency, and the name PHP2Shell is examinable.

UPSCSSCBank

22 October 2026 Source: Al Jazeera

In plain words

PHP A server-side scripting language used to build web pages — Because so many sites run on it, a flaw in PHP affects a large part of the web at once.

Patch A software update that closes a known flaw — Applying it quickly is the main defence against a newly published vulnerability.