Summary (tl;dr)

New critical remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, are causing widespread disruptions globally, including taking popular Pokémon-related applications offline and prompting urgent warnings and website shutdowns across numerous government and essential services, particularly in Europe.

Essential Background

PHP, an acronym for PHP: Hypertext Preprocessor, is a widely-used open-source, general-purpose scripting language specifically designed for web development. It powers a significant portion of the internet's infrastructure, including major content management systems and countless web applications. Due to its pervasive nature, any significant security flaws in PHP can lead to widespread vulnerabilities across many online services and websites.

The Full Story

On October 21, 2026, the PHP development team released emergency security updates to address two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws, both rated 9.2 on the CVSS v4.0 scale, could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers. The vulnerabilities, nicknamed "php2shell," involve memory corruption during out-of-memory handling (CVE-2026-109618) and stale global state between requests (CVE-2026-109619).

Reports of these vulnerabilities and technical details began circulating publicly ahead of the scheduled patch release, intensifying the urgency for administrators. In response, the PHP project urged immediate updates to fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, noting that older, unsupported PHP versions would not receive patches.

The impact has been immediate and extensive. Popular applications such as Pokémon Sleep, Pokémon HOME, Pokémon Champions, and other major Japanese games have been taken offline for emergency maintenance to address these critical PHP security issues. Furthermore, cybersecurity agencies, including CERT-EU, issued warnings advising organizations to patch immediately or consider taking affected internet-facing systems offline. This led to numerous government, hospital, and university websites across Europe, including in Germany, France, Belgium, the Netherlands, Finland, and Denmark, temporarily going offline as a precautionary measure. Cloudflare has also reported observing early attack traffic targeting these vulnerabilities.

Why It Matters

These critical PHP vulnerabilities pose a significant threat to countless online services and users worldwide. The ability for unauthenticated remote code execution means attackers could potentially gain full control over vulnerable web servers, leading to data breaches, website defacement, and the deployment of malicious software. The widespread shutdowns of critical infrastructure websites in Europe and popular gaming applications underscore the severe and immediate real-world consequences of these flaws. The incident highlights the imperative for organizations to implement prompt security updates and maintain robust cybersecurity postures to protect against rapidly evolving cyber threats and ensure the continuity of online services.

Geographic Location

• Europe (widespread website shutdowns across governments, hospitals, and universities in response to PHP vulnerabilities)
  • Germany (federal IT provider ITZBund took several federal websites offline)
  • France (Interior Ministry pulled sites of local prefectures)
  • Belgium (Foreign Ministry took websites down following reports of attacks)
  • Netherlands (national cyber agency, Port of Rotterdam, government portal Overheid.nl, major political parties, and numerous hospitals took websites offline)
  • Finland (state IT centre Valtori shut government's public web services)
  • Denmark (municipal IT company Kombit took down several services, including the national school communication platform)
• Virtual/Online (global impact on gaming services, including Pokémon Sleep, Pokémon HOME, and Pokémon Champions taken offline)