Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Outage tracker

PHP2Shell outages: sites that went offline and when they came back

Government portals, universities, platforms and popular sites that went offline on 21–22 October 2026, as reported in connection with PHP2Shell. Being on this list does not mean a site was compromised: most went offline as a precaution or for maintenance.

Last updated

53Sites tracked
9Still down
44Back up
4h 47mMedian downtime

By country

  • Netherlands24
  • Global10
  • Japan5
  • Finland3
  • United Kingdom3
  • Germany2
  • France2
  • Belgium2
  • Austria1
  • Croatia1

By type

  • Website24
  • Government17
  • Platform9
  • University3

🕒 All times are UTC (24-hour). Duration is the time between the first report offline and the first report back.

Our note
LIFULL HOME'SJapanPlatform——DownX posts Real-estate portal reported offline on X in connection with PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a CDN error, which may reflect regional blocking. [Source]2026-10-22 08:35 · 403
at homeJapanPlatform——DownX posts Real-estate portal reported in maintenance/offline on X, with posts linking it to PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a bot-check page, so it could not confirm the site's state. [Source]2026-10-22 08:41 · 405
SUUMOJapanPlatform——DownX posts Real-estate portal reported offline on X in connection with PHP2Shell. The site shows its own system-maintenance page; the operator has not stated a cause. [Source]2026-10-22 08:35 · 503
D66 (Dutch political party)NetherlandsWebsite2h 47mBackPHPocalypse Tracker Political party site showed a temporary unavailability page for under three hours. [Source]2026-10-22 08:12 · 200
Nespresso Croatia online storeCroatiaWebsite15mBackPHPocalypse Tracker Online store offline briefly for stated security maintenance. [Source]2026-10-22 08:12 · 200
Overheid.nl (Dutch government portal)NetherlandsGovernment12h 20mBackPHPocalypse Tracker Government portal offline for maintenance overnight; back the next morning (UTC). [Source]2026-10-22 08:12 · 200
French prefecture websitesFranceGovernment——DownPHPocalypse Tracker Several prefecture sites show a shared maintenance page; others not checked. [Source]2026-10-22 08:12 · 200
Belgian Foreign AffairsBelgiumGovernment7h 06mBackPHPocalypse Tracker Ministry site returned HTTP 503 in four languages; back after midnight (UTC). [Source]2026-10-22 08:12 · 302
City of Edinburgh CouncilUnited KingdomGovernment5h 06mBackPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about five hours. [Source]2026-10-22 08:12 · 200
Oxford City CouncilUnited KingdomGovernment4h 06mBackPHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about four hours. [Source]2026-10-22 08:12 · 200
Bristol City CouncilUnited KingdomGovernment1h 21mBackPHPocalypse Tracker Council site showed an unavailability notice for under two hours. [Source]2026-10-22 08:12 · 200
Port of RotterdamNetherlandsWebsite2h 36mBackPHPocalypse Tracker Port authority site temporarily unreachable for under three hours. [Source]2026-10-22 08:12 · 301
KNVB (Dutch football association)NetherlandsWebsite1h 41mBackPHPocalypse Tracker Football association sites temporarily unreachable for under two hours. [Source]2026-10-22 08:12 · 200
PVV (Dutch political party)NetherlandsWebsite8h 36mBackPHPocalypse Tracker Political party site offline as a stated precaution until the next morning (UTC). [Source]2026-10-22 08:12 · 200
GroenLinks-PvdA (Dutch political party)NetherlandsWebsite1h 36mBackPHPocalypse Tracker Political party site offline for under two hours. [Source]2026-10-22 08:12 · 403
Acuity SchedulingGlobalPlatform3h 02mBackPHPocalypse Tracker Booking platform and login returned HTTP 503 for about three hours, then returned. [Source]2026-10-22 08:12 · 200
DriveThruRPGGlobalWebsite7h 11mBackPHPocalypse Tracker Digital game store offline for maintenance for about seven hours. [Source]2026-10-22 08:12 · 403
Sakura Internet (domains and SSL)JapanPlatform5h 46mBackPHPocalypse Tracker Domain and SSL control panel under emergency maintenance; notices do not name PHP; hosting and email unaffected. [Source]2026-10-22 08:12 · 200
EFRAG (European Financial Reporting Advisory Group)BelgiumGovernment3h 08mBackPHPocalypse Tracker Site stopped connecting for about three hours, then returned. [Source]2026-10-22 08:12 · 301
DeviantArtGlobalWebsite4h 32mBackPHPocalypse Tracker Art community suspended while applying a software update, then returned. [Source]2026-10-22 08:12 · 200
DigiDNetherlandsGovernment5h 35mBackPHPocalypse Tracker Government login service offline for about six hours, then returned. [Source]2026-10-22 08:12 · 200
MijnOverheidNetherlandsGovernment3h 35mBackPHPocalypse Tracker Government citizen portal offline for under four hours, then returned. [Source]2026-10-22 08:12 · 200
RTL NieuwsNetherlandsWebsite3h 32mBackPHPocalypse Tracker News site offline for under four hours, then returned. [Source]2026-10-22 08:12 · 302
Follow the MoneyNetherlandsWebsite2h 50mBackPHPocalypse Tracker Investigative news site offline for about three hours, then returned. [Source]2026-10-22 08:12 · 200
Platform InvesticoNetherlandsWebsite1h 44mBackPHPocalypse Tracker Journalism platform offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
Nederlandse Orde van Advocaten (Dutch bar association)NetherlandsGovernment1h 44mBackPHPocalypse Tracker Bar association site offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
FC TwenteNetherlandsWebsite5h 50mBackPHPocalypse Tracker Football club site offline for about six hours, then returned. [Source]2026-10-22 08:12 · 301
Fortuna SittardNetherlandsWebsite4h 05mBackPHPocalypse Tracker Football club site offline for about four hours, then returned. [Source]2026-10-22 08:12 · 301
Politievakbond ACP (police union)NetherlandsWebsite16h 34mBackPHPocalypse Tracker Police union site offline until the next morning (UTC). [Source]2026-10-22 08:12 · 301
KNMP (Dutch pharmacists' association)NetherlandsWebsite2h 20mBackPHPocalypse Tracker Pharmacists' association site offline for about two hours, then returned. [Source]2026-10-22 08:12 · 200
Scouting NederlandNetherlandsWebsite1h 44mBackPHPocalypse Tracker Scouting association site offline for under two hours, then returned. [Source]2026-10-22 08:12 · 200
Kustwacht (Netherlands Coastguard)NetherlandsGovernment4h 35mBackPHPocalypse Tracker Coastguard site showed an unavailability page with emergency numbers; back later that day. [Source]2026-10-22 08:12 · 301
Security.NLNetherlandsWebsite6h 05mBackPHPocalypse Tracker Security news site switched to maintenance mode, citing PHP2Shell as the reason. [Source]2026-10-22 08:12 · 200
easybillGermanyPlatform2h 20mBackPHPocalypse Tracker Invoicing web app offline (HTTP 503) as a stated precaution; vendor said data was safe. [Source]2026-10-22 08:12 · 302
Choice of GamesGlobalWebsite2h 20mBackPHPocalypse Tracker Game publisher site showed a temporary 503 page, then returned. [Source]2026-10-22 08:12 · 200
CNIL (French data protection authority)FranceGovernment——DownPHPocalypse Tracker Data protection authority site returns a maintenance page (HTTP 503) with no stated reason. [Source]2026-10-22 08:12 · 503
Tweede Kamer (Dutch parliament)NetherlandsGovernment8h 02mBackPHPocalypse Tracker Parliament website showed a maintenance notice; back the same evening. [Source]2026-10-22 08:12 · 200
NCSC (Dutch national cyber security centre)NetherlandsGovernment7h 02mBackPHPocalypse Tracker National cyber security centre site taken offline; back the same evening. [Source]2026-10-22 08:12 · 200
Autoriteit Persoonsgegevens (Dutch data protection authority)NetherlandsGovernment——DownPHPocalypse Tracker Data protection authority site offline; no recovery recorded by the source. [Source]2026-10-22 08:12 · timeout
Valtori (Finnish central government web services)FinlandGovernment18h 07mBackPHPocalypse Tracker Shared government web services offline; recovery recorded the next morning (UTC). [Source]2026-10-22 08:12 · timeout
National Land Survey of FinlandFinlandGovernment——DownPHPocalypse Tracker Land survey agency site shown as down; no recovery recorded by the source. [Source]2026-10-22 08:12 · 503
University of ViennaAustriaUniversity4h 17mBackPHPocalypse Tracker University website offline for a few hours, then returned. [Source]2026-10-22 08:12 · 200
University of FreiburgGermanyUniversity21h 01mBackPHPocalypse Tracker Home page carried a computing-centre notice about the PHP flaws; the tracker saw the regular home page again on 22 Oct at 08:10 UTC. [Source]2026-10-22 08:24 · 301
Haaga-Helia University of Applied SciencesFinlandUniversity——DownPHPocalypse Tracker University website offline; no recovery recorded by the source. [Source]2026-10-22 08:12 · 301
TweakersNetherlandsWebsite4h 59mBackPHPocalypse Tracker Tech news site offline for about five hours, then returned. [Source]2026-10-22 08:12 · 403
Fur AffinityGlobalWebsite11h 47mBackPHPocalypse Tracker Art community offline until late evening (UTC). [Source]2026-10-22 08:12 · 403
PinboardGlobalWebsite12h 02mBackPHPocalypse Tracker Bookmarking service offline until late evening (UTC). [Source]2026-10-22 08:12 · 200
Miraheze (all wikis)GlobalPlatform10h 02mBackPHPocalypse Tracker Wiki farm offline across all hosted wikis, then returned. [Source]2026-10-22 08:12 · 301
4chanGlobalWebsite11h 47mBackPHPocalypse Tracker Imageboard offline until late evening (UTC). [Source]2026-10-22 08:12 · 302
NotuBiz council portalsNetherlandsPlatform——DownPHPocalypse Tracker Council meeting portals run by NotuBiz went offline; reported in connection with PHP2Shell. [Source]2026-10-22 08:12 · 301
explain xkcdGlobalWebsite9h 59mBackPHPocalypse Tracker Community wiki went offline for several hours, then returned. [Source]2026-10-22 08:12 · 301
Star Citizen WikiGlobalWebsite4h 59mBackPHPocalypse Tracker Fan wiki taken offline for about five hours, then returned. [Source]2026-10-22 08:12 · 200
CodmonJapanPlatform9h 41mBackPHPocalypse Tracker Childcare communication service stopped under emergency maintenance; restored by the evening (UTC). [Source]2026-10-22 08:12 · 200

“Our check” is a single HTTP status request per site, made by us at the time shown. It is not a scan and does not test for vulnerabilities; a 403 or timeout can simply mean the site blocks automated requests.

Report a site that went offline

Know of a site that went offline in connection with PHP2Shell, or one that is back up? Tell us. Every submission is reviewed by hand before it appears in the table, labelled “User report (reviewed)”.

Questions

Were these sites hacked through PHP2Shell?

Not as far as the sources say. Most sites posted maintenance or precaution notices while they patched PHP. We list them as having gone offline in connection with PHP2Shell, not as compromised.

Where does the outage data come from?

The rows were seeded from the public-domain PHPocalypse Tracker and each row links its original source, such as a news report, a post, or the site's own notice. We add our own HTTP status check time.

What time zone are the times in?

All offline and recovery times are in UTC. For example, 17:05 UTC is 19:05 in Amsterdam (CEST) and 01:05 the next day in Kuala Lumpur.

How often is the table updated?

Our intel routine reviews new reports about every 10 minutes during the day and updates rows once they are verified.