In short: Two critical flaws in PHP, together called “PHP2Shell”, let attackers run their own code on web servers without logging in. Details leaked early, and patches followed on the afternoon of 21 October 2026. The German Federal Office for Information Security (BSI) has issued an orange warning. If you run a website on PHP, install the update today and then check whether anyone got in before.
What happened
PHP is the programming language behind a large share of all websites, for example every site built on WordPress, TYPO3 or Magento. According to W3Techs, around 70% of websites with a known server technology use PHP (as of October 2026).
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. A CVE number is the worldwide standard identifier for a vulnerability. Both score 9.2 out of 10 on CVSS, the common scale for rating severity. Every PHP installation that answers requests from the internet is affected, whether via PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed.
Why it is so urgent right now
Normally, details of a flaw are published together with the fix. This time they leaked on 20 October 2026, two days ahead of schedule. The PHP team therefore brought the updates forward to 21 October 2026 at 16:00 CEST. Attackers knew about the weakness before many operators could patch. The BSI compares the situation to Log4Shell, the Java flaw from 2021, hence the name.
Several security firms report first attack attempts, although widespread exploitation is not yet confirmed. The BSI advises: if you cannot update immediately, take the server offline when in doubt.
Why public authorities and hospitals are switching off their sites
Since the afternoon of 21 October, websites of German municipalities, authorities, universities and hospitals have been unreachable. The city of Mainz, for example, took mainz.de offline. This is a precaution following the BSI recommendation. A site that is switched off has not automatically been hacked. Operators install the update and check their servers before going back online.
What to do now
- List every PHP installation. This includes sites run for you by an agency or hosting provider: website, careers portal, shop, intranet, booking flow.
- Install the update or get written confirmation. Safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask your hosting provider in writing whether this version is running. According to the BSI, the end-of-life versions 7.4, 8.0 and 8.1 receive backported fixes, but no regular release.
- Bridge the gap if it cannot be done today. Disabling
session.upload_progress.enabledreduces the risk but does not replace the update. Taking the site offline until it is patched is safer. - Look for traces. An update closes the gap, but it does not tell you whether someone got in before. Check the web folder for new or unknown files and your servers for PHP processes that start a shell or tools such as curl and wget.
- Report if something looks wrong. Organisations covered by NIS 2 report a significant incident to the BSI within 24 hours. Credentials stored on an affected server are considered known and get changed.
What this case shows
A website is often treated as a marketing channel, not as part of IT. Yet it runs on a server connected to the internet that often holds forms, customer data and access to other systems. If you do not know which PHP version your agency runs and who installs updates in an emergency, you lose hours in situations like this. A short list of all web applications with an owner for each, plus an agreed patch route with your provider, solves that.
How GermanAI Defense helps
We offer a website quick check: we list your public web applications, check the PHP version and patch level from the outside and, on request, look for traces of intrusion on the server. You receive a short list of findings and next steps.
→ More on our Cybersecurity Services: View Cybersecurity Services
Sources: BSI cyber security warning, version 1.1, 21 Oct 2026 · Huntress, 21 Oct 2026 · ZDFheute, 21 Oct 2026 · W3Techs