PHP flaws: Security agencies advise taking sites offline
On Wednesday, authorities, hospitals, universities and governments in several European countries took their websites offline as a precaution. Two critical PHP flaws could allow code execution without authentication. Several security agencies advised shutting systems down where immediate updates were impossible. Meanwhile, developer platforms reported attacks on their customers’ credentials.
Key takeaways
- Several security agencies advised shutting systems down. CISA and CERT-EU recommended taking PHP systems offline if they could not be updated immediately.
- The flaws had been in the code for over a decade. According to Wiz Research, frontier AI models helped find them and make them exploitable.
- Developer platforms reported breaches. Data from 321,810 Zeabur accounts was stolen, while Railway advised all users to rotate keys stored on its platform.
Related: OpenSSL: What vendors must now demonstrate · Simon Gooch: AI agents need a tested stop mechanism
Websites shut down as a precaution
A patch for two critical PHP flaws was scheduled for 16:00 German time on Wednesday. BSI (Germany’s Federal Office for Information Security) called for it to be installed immediately upon release. CERT.at advised identifying PHP systems and scheduling an update window for 16:00.
According to W3Techs, PHP powers 69.3 percent of all websites whose server-side programming language is known. Source
In Berlin, the websites of the Robert Koch Institute, the Federal Intelligence Service (BND), the Federal Criminal Police Office (BKA), customs and the Federal Police were temporarily offline. In Brandenburg, affected sites included Ernst von Bergmann Hospital, the University of Potsdam and the police’s online service portal. Some portals were back online after 17:00. A spokesperson for the Federal Ministry for Digital Affairs said ITZBund, the federal government’s IT service provider, had taken several websites offline as a precaution. No security incidents were known.
In North Rhine-Westphalia, many hospital websites were unavailable, including those in Cologne, Bonn, Düsseldorf and Bielefeld. Online services run by the State Office for Central Police Services, including online crime reporting, were unavailable for hours. All affected organisations stressed that the shutdowns were precautionary.
The University of Vienna shut down central IT services and gradually restored them after updating. The Dutch National Cyber Security Centre (NCSC) took its own website offline. According to Reuters, the Port of Rotterdam, the government portal Overheid.nl and numerous hospitals followed. France’s prefecture websites went offline, as did Finland’s public government web services. The Czech government followed at 19:00 local time. The Wikimedia Foundation deliberately took services including Toolforge and Cloud VPS offline. In Japan, Prime Minister Sanae Takaichi described temporarily disabling website functions as an effective way to reduce the risk.
What is remote code execution? Remote code execution describes a vulnerability that lets an attacker remotely run their own code on another system. If authentication is unnecessary, access to the affected service is sufficient. PHP2Shell affects all PHP installations that handle web requests.
Official advice to take systems offline
The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching of PHP systems. Together with the National Security Agency (NSA) and Federal Bureau of Investigation (FBI), it advised taking systems offline if they could not be secured quickly. CERT-EU recommended isolating accessible applications from the public network until the fix was installed and verified. The UK’s National Cyber Security Centre (NCSC) called for immediate action and migration to supported versions. Switzerland’s Federal Office for Cyber Security (BACS) highlighted applications and devices that use PHP as a component.
| Fact | Source |
|---|---|
| The NSA, FBI and CISA jointly urged organisations to fix both flaws and advised taking systems offline if they could not be secured quickly. | Source |
| CERT-EU advises isolating internet-accessible applications from the public network until the fix is installed and verified if immediate patching is impossible. | Source |
| CERT.at recommended identifying systems using PHP, scheduling an update window for 16:00 and considering shutting systems down where possible. | Source |
| The UK’s NCSC urged organisations to act immediately. Organisations using any PHP version were affected; those using older versions should migrate to a supported version. | Source |
| Switzerland’s Federal Office for Cyber Security (BACS) advises updating affected systems immediately and checking applications and devices that use PHP as a component, alongside web servers. | Source |
PHP powers 69.3 percent of all websites whose server-side programming language is known. All PHP installations handling web requests are affected. PHP 8.1 and earlier receive no official fixed releases. For 7.4, 8.0 and 8.1, the PHP security team provided minimal source-code backports, fixes transferred as source code to older release branches. Some distributions and long-term support (LTS) providers also supply patched packages.
The details leaked on Tuesday ahead of coordinated disclosure. According to watchTowr, the embargo, the agreed deadline before publication, was set for Thursday. CISA said it had observed no exploitation by the time of publication.
Old flaws and AI tools
The pair of vulnerabilities is nicknamed PHP2Shell, echoing Log4Shell. Wiz.io and Calif.io discovered them, with OpenAI involved. According to Wiz Research, frontier AI models, the most capable AI systems available, helped identify the flaws and make them exploitable. The flaws had reportedly been in the code for more than a decade, affecting versions as far back as PHP 5.4. Wiz believes that without AI, the attack chain would have approached the limits of what human researchers could practically achieve.
The same day, GitLab fixed a flaw in the compilation of regular expressions, patterns used to search text. It has a Common Vulnerability Scoring System (CVSS) score of 10.0 and allows unauthenticated attackers to execute code on the server under certain conditions. All versions from 7.0 onwards are affected. Version 7.0 was released in June 2014, dating the flaw back twelve years. Node.js released updates for branches 22.x, 24.x and 26.x, addressing issues including remote code execution in the Brotli decoder for compressed data.
Attacks on developer platforms
Version 1.107.0 of the LiteLLM AI gateway library was compromised. All wheels on PyPI, the ready-to-install packages in the Python package repository, contained a credential stealer, a program that harvests access credentials. It ran whenever the Python interpreter started, collecting SSH keys, cloud credentials for AWS, Azure and Google Cloud, and Kubernetes tokens, among other data. LiteLLM confirmed the incident had been contained. Versions 1.82.7 and 1.82.8 had already been compromised in March 2026.
| Fact | Source |
|---|---|
| Version 1.107.0 of the LiteLLM AI gateway library was compromised: all wheels on PyPI contained a credential stealer and a loader for external code, which run automatically whenever the Python interpreter starts, without requiring LiteLLM to be imported. The Docker tags latest, main-latest and main-stable were also affected. | Source |
| Hosting platform Railway reported that an unauthorised party may have accessed customers’ encrypted environment variables and decrypted some of them. Railway paused all deployments and advised all users to rotate every environment variable, API key and registry credential stored on its platform. | Source |
| Zeabur announced its closure on its blog, citing a second security incident. The first services will end on 1 December 2026, with all dedicated servers and shared clusters closing by 31 December 2026. | Source |
| According to PingCAP, the copied records included usernames, email addresses, contract and pricing data, and a table containing encrypted API keys for TiDB Cloud. PingCAP has not confirmed the attackers’ claims concerning additional credentials. | Source |
At hosting platform Railway, an unauthorised party may have accessed customers’ encrypted environment variables and decrypted some of them, according to the company. Environment variables are configuration values a platform passes to applications. Railway paused all deployments and advised all users to rotate every variable, API key and registry credential stored there. The company links the incident to a series of attacks on platform companies targeting AI inference providers.
Zeabur confirmed its second security incident in two months on 17 October. An attacker used internal credentials stored in plaintext to steal data from 321,810 accounts and around 3.2 million environment-variable records. The admin tokens had not been rotated since January 2024. The platform will shut down by the end of December 2026. At PingCAP, an unauthorised party used stolen service-account credentials to access internal systems between 9 September and 7 October 2026, copying data including encrypted API keys for TiDB Cloud.
Three preparations before the next critical flaw
When BSI issued its warning, there was no confirmed exploitation of PHP2Shell, although unconfirmed reports suggested exploits existed. IT managers can prepare three things before the next vulnerability of this kind.
– Inventory PHP beyond the web server. BACS advised checking applications and devices that use PHP as a component. An up-to-date list of these systems speeds up searches in an emergency. – Fallback operations for websites and portals. On Wednesday, North Rhine-Westphalia’s online crime-reporting service was down for hours, while Brandenburg’s police portal and many hospital websites were unavailable. During its shutdown, the Dutch NCSC directed users to advisories.ncsc.nl and LinkedIn. Such alternatives for citizens and customers should be established before an alert. – Secrets with expiry dates. Railway advised all users to rotate their stored keys. At Zeabur, admin tokens never expired and had remained unchanged since January 2024. Short lifetimes and regular rotation limit the damage when a platform provider loses data. Stolen or guessed passwords are also among the entry points used by the ransomware group SafePay, which the FBI, CISA and Rhineland-Palatinate’s State Criminal Police Office (LKA) jointly warned about on Tuesday.
Frequently asked questions
Each question is locked. Tap to unlock the answer.
Which PHP versions fix PHP2Shell?
On 21 October 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Which GitLab versions include the fix?
The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched; self-managed installations should be updated immediately.
Which LiteLLM artefacts were compromised?
Alongside the version 1.107.0 wheels on PyPI, Docker tags latest, main-latest and main-stable were affected. Package 1.107.0 was withdrawn from PyPI and Docker image v1.107.0 was removed. The latest, main-latest and main-stable tags point to safe images again.
Editor’s Picks
Editor’s PickWhen the Security Stack Outgrows the Strategy
More from the MBF Media Network
cloudmagazinGoogle counters Meta with top AI at half the priceDigital ChiefsMicrosoft: Germany Is EU’s Top Cyberattack Target
Image source: AI-generated (October 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
