Critical PHP Vulnerabilities Force Government Websites Offline — Even Wordfence Takes Its Website Down

Two critical PHP vulnerabilities have triggered an emergency security response across the internet. Government agencies in several European countries have temporarily taken websites offline, while security companies and hosting providers are rushing to protect their infrastructure.

Even Wordfence, one of the most recognized names in WordPress security, temporarily took its own website and several services offline while implementing protections against the vulnerabilities, collectively known as PHP2Shell.

According to Reuters, government websites in the Netherlands, Finland and other European countries were taken offline as a precaution following warnings about the security flaws.

Government Websites Taken Offline Across Europe

The situation is serious enough that government agencies have chosen to temporarily interrupt public services rather than risk exposing their systems to potential attacks.

Reuters reported several significant disruptions on October 21:

• Netherlands: The National Cyber Security Centre (NCSC) temporarily took its own website offline. Other affected organizations included the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB and several hospitals.
• Finland: Government IT services provider Valtori took public network services offline as a precaution.
• Denmark: Municipal IT provider Kombit shut down several services, including the national school communication platform.
• France: The Interior Ministry temporarily disabled local government administrative websites while awaiting security fixes.

These shutdowns were precautionary measures. They do not necessarily mean the affected organizations were hacked.

However, the scale of the response shows how seriously security teams are treating the vulnerabilities.

Even Wordfence Temporarily Shut Down Its Website

One of the most interesting developments was Wordfence’s decision to temporarily take its own website and several services offline.

When I visited Wordfence.com on October 21, the website displayed a plain black page with a security notice:

Wordfence services are temporarily unavailable as we implement mitigations for the currently unpatched PHP2Shell vulnerability.

Wordfence’s official status page also confirmed the incident, which began at 12:33 UTC on October 21.

At the time of the status check, Wordfence reported downtime affecting its website, Wordfence Central and plugin servers, while the plugin service was listed as degraded.

This is particularly noteworthy because Wordfence specializes in protecting WordPress websites from malware, vulnerabilities and malicious traffic.

Its decision illustrates how seriously even established security companies are treating the situation.

It also reinforces an important distinction: temporarily taking services offline to prevent an attack is not the same as experiencing a security breach.

The Wordfence message was displayed before the PHP security fixes became available. The patches have since been released, although individual providers may still need time to deploy them.

What Is PHP2Shell?

PHP2Shell refers to two critical vulnerabilities affecting PHP, the server-side programming language used by WordPress and many other web applications.

The vulnerabilities are identified as:

• CVE-2026-109618: A remote code execution vulnerability involving corruption during out-of-memory handling.
• CVE-2026-109619: A remote code execution vulnerability involving stale internal state and previously freed memory.

Both vulnerabilities received a CVSS v4.0 severity score of 9.2 out of 10 (Critical).

According to the official PHP security advisory, these vulnerabilities can potentially allow unauthenticated attackers to execute code remotely on vulnerable servers.

That means attackers may be able to compromise a server without first obtaining a WordPress administrator account.

Unlike a typical WordPress plugin vulnerability, the problem exists in PHP itself.

Updating WordPress core, themes or plugins will not fix the underlying PHP vulnerability.

PHP Security Updates Have Been Released

On October 21, the PHP development team released security updates addressing both vulnerabilities.

The following patched versions are available:

PHP Branch	Security-Fixed Version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and older no longer receive regular security releases directly from the PHP project. Some Linux distributions and commercial support providers may supply backported patches.

The PHP team strongly recommends applying the appropriate security updates immediately.

However, the availability of a new PHP release does not mean every hosting company has already deployed it.

Shared hosting users are particularly dependent on their providers to make the patched PHP builds available.

Cloudflare Is Deploying Additional Protections

Cloudflare has also responded to the threat by deploying web application firewall protections.

In its official security update, Cloudflare described its work on protections against PHP2Shell.

However, firewall protection should be treated as an additional defense rather than a replacement for installing PHP security updates.

A firewall may help block known malicious requests, but it cannot guarantee protection against every possible exploitation method.

The PHP security team has made clear that updating the affected PHP runtime is the only complete solution.

What WordPress Website Owners Should Do Now

If your website runs on WordPress, there are several important steps to take.

1. Check your PHP version. In WordPress, go to Tools → Site Health → Info → Server. You can also check the PHP version through your hosting control panel.
2. Confirm your hosting provider has applied the patch. Ask whether your server is running a fixed PHP release or a vendor-maintained build with the relevant security fixes backported.
3. Update PHP when the patched version becomes available. Take a backup first and verify compatibility with your WordPress installation.
4. Review your security logs. Check for suspicious requests, unexplained PHP files, unexpected administrator accounts and other indicators of compromise.
5. Do not rely on WordPress automatic updates. PHP is part of the server environment and requires a separate update process.

For organizations that cannot patch immediately, temporary isolation or taking affected services offline may be necessary depending on the level of exposure.

Simply enabling a security plugin is not a substitute for patching the server.

A Reminder About Website Security

I have worked on WordPress malware removal and hacked website recovery since 2018, and one lesson continues to stand out: website security goes beyond WordPress itself.

A website can have updated plugins, a clean theme and strong administrator passwords while still being exposed through vulnerabilities in its underlying server software.

This incident demonstrates why server maintenance matters just as much as application maintenance.

When government agencies and even a dedicated WordPress security company temporarily disable services in response to a vulnerability, website owners should pay attention.

The most important step now is to confirm that the affected PHP installations have received the necessary security fixes.

Sources and further reading:

• Reuters — Government Websites Go Dark as Software Flaw Sparks Security Scramble
• PHP Official Security Advisory — October 21, 2026
• Wordfence Official Status Page
• Cloudflare — Protections Against PHP2Shell