PHP2Shell Outages: Which Websites Went Offline
On October 21, 2026, government portals, game publishers and online services took websites offline because of PHP2Shell. This list covers the PHP2Shell outages reported by the organisations themselves or by news outlets. Almost all were precautionary shutdowns while PHP was updated, not hacks.
Why PHP2Shell caused outages
The details of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) leaked a day before the planned release. With patches not yet out, the UK NCSC told operators to consider taking systems offline if they could not protect them, and CERT-EU advised isolating internet-facing applications that could not be patched. Many organisations chose to pause their sites rather than run an unpatched PHP version during that window.
PHP2Shell outages in the Netherlands
- Dutch parliament (Tweede Kamer): website taken offline temporarily as a precaution, confirmed by a spokesperson (NL Times).
- NCSC-NL: the national cyber security centre took its own site offline (NL Times).
- DigiD and MijnOverheid: the national login and government inbox services were among the many sites paused (Dutch Brief, Patchstack).
- Others reported: the Data Protection Authority, NotuBiz local-government services, RTL, Tweakers, DPG Media sites, the KNVB and several football clubs (Dutch Brief).
PHP2Shell outages in the rest of Europe
- Finland: state IT provider Valtori took public-facing government network services offline.
- France: Interior Ministry websites were taken down.
- Germany and Austria: Charité hospital in Berlin and several universities were reported affected.
- Wikimedia: deliberately took supporting services offline, including Toolforge and Cloud VPS, and warned that wikis could have interruptions (Wikimedia Diff blog).
Games and online services hit by PHP2Shell downtime
- Nintendo: took services offline (The Record). Pokémon HOME, Pokémon Sleep and Switch online services had maintenance, though Dexerto notes Nintendo had not confirmed a PHP link.
- GOG: taken offline for maintenance (PC Gamer).
- Final Fantasy XIV: new logins were temporarily suspended on all worlds on October 21 (official Lodestone notice).
- OBS Project and Oh Dear: reported affected (The Record).
- Forums: 4chan and Something Awful were reported offline, a single-source report.
PHP2Shell emergency maintenance in Japan
- Cygames: Umamusume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond and Princess Connect! Re:Dive entered emergency maintenance from about 23:00 JST on October 21. The Umamusume notice says a PHP vulnerability was found in its servers.
- Other services: pixiv BOOTH, Niconico, Bushiroad, Bandai Channel, BASE, Sakura Rental Server and the Xserver control panel announced or began emergency maintenance (Denfaminicogamer, ITmedia).
- Arcade and others: CHUNITHM international reported emergency maintenance citing PHP (Dexerto).
Official PHP2Shell advisories
| Agency | Advice |
|---|---|
| CERT-EU (Advisory 2026-018) | Patch now; isolate internet-facing applications that cannot be patched |
| UK NCSC | Update PHP; take systems offline if mitigations cannot be applied; check for compromise |
| NCSC-NL | Public GitHub repository listing PHP-dependent software and guidance |
| US NSA | "PHP Updates" advisory |
| Germany (BSI), Japan, Australia (ASD) | Warnings urging operators to patch |
| CISA | Not on the Known Exploited Vulnerabilities list when checked |
Is your site safe?
Whether your site stayed online says nothing about its PHP version. Run the PHP2Shell checker, then follow the patch guide. For background, see what PHP2Shell is.
PHP2Shell outages FAQ
Were these websites hacked?
Almost all of them went offline as a precaution while they updated PHP, not because of a confirmed breach. Dutch coverage described the shutdowns as a precaution, not the result of a hack.
Why did governments take websites offline?
The vulnerability details leaked before patches were available. The UK NCSC advised taking systems offline if they could not be protected, and several national CERTs urged immediate action, so many public bodies paused their sites until PHP was updated.
Was Steam taken down by PHP2Shell?
We could not find a statement from Valve or a news report that links a Steam outage to PHP2Shell, so it is not on this list.
How should a site go offline without hurting SEO?
Google's John Mueller advised returning HTTP 503 during planned downtime rather than letting requests time out or show errors. A short 503 period normally does not affect rankings.
When will the sites come back?
Most services returned within hours to a day, once their PHP runtimes were updated. Check each service's own status page.