On Wednesday, Oct. 21, governments in at least five countries had public websites go dark over PHP2Shell, a pair of critical PHP flaws that already had a fix scheduled. The Netherlands, Finland, Denmark and France switched services off on purpose; in Australia, cyber.gov.au and other government websites reported outages. Taking government websites offline over a patchable bug looks like overkill. The official advisories explain why it was the textbook response.
Where it stands: None of the outages has been reported as a breach. ABC, citing Reuters, described the European takedowns as precautions taken ahead of the fix, and Newsweek reported no evidence that U.S. federal sites were compromised or taken offline. CISA said in its Oct. 21 alert that it had not observed exploitation.
Which government websites went offline, and where?
Five countries are named in the reporting so far, each with a slightly different kind of disruption. The details below come from ABC News, which credits Reuters for much of the European material.
| Country | What happened |
|---|---|
| Netherlands | Agencies took sites offline as a precaution; the Dutch cyber agency took its own site down too |
| Finland | State IT provider Valtori took government public network services offline |
| Denmark | Municipal IT company Kombit shut several services, including the national school communication platform |
| France | Interior Ministry temporarily took local government administrative websites offline |
| Australia | cyber.gov.au and other government sites reported outages while risks were mitigated |
By ABC’s account, the disruption was widest in Finland. It reports that Valtori, the state IT services provider, took government public network services offline “as a precautionary measure”. The most symbolic was the Netherlands, where the national cybersecurity agency itself went offline.
Australia’s case is slightly different. The Australian Signals Directorate said its cyber.gov.au site and other government websites had reported outages, and a spokesperson for Home Affairs Minister Tony Burke told ABC: “Some websites are temporarily unavailable as work is undertaken to mitigate risks arising from this vulnerability.”
Why take government websites offline when a patch exists?
Because the patch and the protection are not the same thing until the patch is installed, and four facts made that gap dangerous.
- Severity. PHP2Shell can let an attacker with no login run code on a server, one of the most serious outcomes for a web bug.
- No real workaround. PHP’s advisory says “There are no complete mitigations, updating is the only safe choice.” Temporary settings exist, but they only narrow the exposure.
- Timing. The two CVE IDs began circulating on Oct. 20, and the release was set for 14:00 UTC the next day. Agencies that acted early, as the Dutch and Finnish ones did according to ABC, were offline before the fix even shipped.
- Public exploit talk. CERT-EU wrote that with technical details and early proof-of-concept code circulating, the likelihood “that attackers are already exploiting the vulnerabilities” rises.
Put together, a government web team faced a choice between leaving a known-critical hole open during the hours it takes to patch and test, or losing a service for those hours. The agencies named here evidently judged a short outage to be the lesser risk.
What did CISA, NCSC and CERT-EU tell organizations to do?
Each of them told organizations that could not patch quickly to disconnect or isolate systems, so the takedowns line up with official advice.
- CISA (U.S.): organizations “that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.”
- NCSC (UK): if temporary mitigations cannot be applied, or would take too long, organizations “should consider taking the system offline until it can be fully mitigated.” The NCSC also told organizations that “any version of PHP” is affected.
- CERT-EU: if a patch cannot go on right away, cut public-facing applications off from outside networks, and keep them off until the fix is installed and checked.
- NSA (U.S.): per The National, the agency’s post said systems that cannot be updated at once should come offline until fully mitigated. TechCrunch reported the same update-or-unplug advice.
Leaders weighed in too. The National reports that Japan’s Prime Minister Sanae Takaichi posted: “We have an urgent request for everyone to take action tonight.”
Why governments are harder to patch than a single website
Government IT is rarely one server. It is a mix of content sites, citizen portals, vendor products and old systems, and PHP hides in many of them. CISA’s alert warns that “PHP is often a component of other software and prevalence may not be directly observable.”
The Dutch NCSC made the same point in the repository it published to track affected products: PHP sits inside appliances, network devices and management interfaces “where administrators may not be able to update PHP directly.” An agency in that position has to wait for each vendor’s update, and switching off the exposed interface is the only lever it fully controls.
Old versions add to the problem. The PHP project says that “PHP 8.1 and older no longer receive updates from the PHP project”, so a department still running an older branch cannot simply install the Oct. 21 release. Our guide to unsupported PHP versions and PHP2Shell covers that long tail.
The PHP Foundation itself listed government services first when describing what runs on PHP, ahead of online stores, banks and media sites.
Were any government sites actually hacked?
None has been reported. The outages in the table were described by the governments and their IT providers as precautions or mitigation work. Newsweek wrote that there was “no evidence that U.S. federal government websites have been compromised or taken offline because of PHP2Shell.”
Whether attackers have managed to use the bugs anywhere is still being argued by security firms; we lay out each claim in is PHP2Shell being exploited. The full sequence of the day is in our October 21 timeline.
What this means if you use government services
If a government site was unavailable on Oct. 21 or 22, the reasons reported so far are precautions and mitigation work, not hacks. There is no reported data exposure to act on. Be wary of emails or texts that use the outage as a hook, such as messages asking you to “re-verify” an account; our guide on spotting a legitimate government breach notice applies here too.
Denmark’s Kombit, the municipal IT company, told Reuters the services it shut down included the national school communication platform.
Frequently Asked Questions
Why did government websites go offline because of PHP2Shell?
Several governments took sites offline as a precaution while the PHP fix was pending or being applied. The flaws could let an outsider run code on a server without logging in, PHP said there was no complete mitigation short of updating, and agencies such as CISA and the UK NCSC advised taking systems offline if they could not be patched quickly.
Which countries took government websites offline over PHP2Shell?
According to ABC and Reuters, government agencies in the Netherlands and Finland took sites offline, France took local government administrative websites offline, and Denmark’s municipal IT company Kombit shut down several services. Australian government websites, including cyber.gov.au, reported outages.
Were the government websites hacked?
No breach has been reported. The takedowns were described as precautionary. Newsweek reported no evidence that U.S. federal government websites had been compromised or taken offline because of PHP2Shell, and CISA said it had not observed exploitation when it published its alert.
Did the US government take websites offline?
There is no evidence of that. Newsweek reported none, although the NSA, according to The National, told organizations to take systems offline if an immediate update was not feasible.
Why not just patch instead of going offline?
Patching takes time across a large estate of servers, and PHP is often buried inside other software and appliances that agencies cannot update themselves. Until each system is patched and checked, unplugging it is the only step that fully removes the exposure.
Sources
- Australian government sites among those exposed to ‘critical’ PHP software flaw — ABC News (Australia), with Reuters, October 22, 2026 (AEDT)
- Critical Vulnerabilities in PHP Require Immediate Patching — CISA, October 21, 2026
- Critical security issue affecting PHP — UK National Cyber Security Centre, October 21, 2026
- Critical Vulnerabilities in PHP (Security Advisory 2026-018) — CERT-EU, October 21, 2026
- PHP security issues: Websites go offline amid critical update — The National (Cody Combs), October 21, 2026
- The internet is having a very bad cybersecurity day — TechCrunch (Sarah Perez), October 21, 2026
- PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble — Newsweek, October 21, 2026
- php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) — NCSC-NL (Dutch National Cyber Security Centre), GitHub, October 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP.net (PHP security team), October 21, 2026
- Today’s PHP Security Release, and How We’re Strengthening PHP Security — The PHP Foundation, October 21, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.