The Week Governments Pulled the Plug: Why Public Bodies Took PHP Sites Offline Instead of Patching

In the week of 21 October 2026, cyber agencies in the United States, the European Union, the United Kingdom and the Netherlands gave the same instruction about two critical PHP vulnerabilities: patch now, and if you cannot, take the affected systems offline. Several governments did exactly that, and the Dutch government took sites such as MijnOverheid.nl and DigiD offline as a precaution. In the UK, a minister told the House of Lords that 32 government services were unavailable, largely because of precautionary measures.

The lesson is not that these bodies failed. Where getting to a verified patch takes days, switching a service off is the controlled option that is left, and this week showed how often public IT is in that position.

Scope: this article relies only on what the institutions published between 21 and 23 October 2026. Dutch quotes are given in the original with an English translation. “Offline” means a precautionary step, in the institutions' own words. None of these sources reports a confirmed compromise of the bodies named or the share of servers that went offline.

What happened, in dates

• 21 October 2026: PHP publishes 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix CVE-2026-109618 and CVE-2026-109619. CISA says the pair, known as “php2shell”, allows unauthenticated remote code execution.
• 21 October: CISA and a joint EU statement (the European Commission's DG CNECT, ENISA, CERT-EU, Europol EC3 and the EU CSIRTs network) tell organisations to patch immediately.
• 21 October, 15:13 local time: the Dutch central government reports that several of its websites have been taken offline as a precaution, before the update was out.
• 22 October: a Private Notice Question on the PHP vulnerability is answered in the House of Lords.
• 23 October: CISA revises its alert, adding a detection rule and reinforcing the existing mitigation guidance.

What the agencies said

CISA's alert is direct about the fallback: “Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.” It also warns that inventory is harder than it looks: “PHP is often a component of other software and prevalence may not be directly observable.” At publication, CISA said it had “not observed successful exploitation of these vulnerabilities in the wild”.

The EU joint statement uses softer wording with the same direction: “Where immediate remediation is not feasible, consider isolating exposed applications from public networks until fixes can be applied.” It adds that “Many commercial and open-source products rely on PHP in the background”, so some organisations may be affected even where PHP is not visible.

In the Netherlands, the government's news item relays the advice of the Dutch National Cyber Security Centre (NCSC). Website owners should “zelf een risicoafweging te maken en hun websites eventueel preventief offline te halen tot die update er is” (make their own risk assessment and, if needed, take their websites offline as a precaution until that update is available). The item adds: “Dit geldt ook voor Rijksoverheidsorganisaties” (This also applies to central government organisations).

What governments did

The Dutch item says that several sites were “uit voorzorg offline gehaald” (taken offline as a precaution), “Bijvoorbeeld ook overheidswebsites als Overheid.nl, MijnOverheid.nl en DigiD” (including government websites such as Overheid.nl, MijnOverheid.nl and DigiD). It also gives the other side: “Op een groot deel van de websites van de Rijksoverheid, zoals Rijksoverheid.nl, wordt geen gebruik gemaakt van PHP” (a large part of central government websites, such as Rijksoverheid.nl, do not use PHP).

In the UK, Baroness Lloyd of Effra answered for the Government on 22 October. Departments had been alerted before public disclosure and “advised to identify potential affected systems, assess their exposure and prepare to implement mitigations and security updates as they became available”. On impact, she said: “32 government services are unavailable and four are partially unavailable.” That, she said, “has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied”, and “The advice of the NCSC is to mitigate and then restore the services.”

Why offline was the realistic option

Patching on disclosure day assumes three things: you know where PHP runs, there is a fixed release for your branch, and you can test, approve and deploy it within hours. Public estates often miss at least one of them.

Inventory is the first gap. CISA and the EU statement both warn that PHP sits inside other products, so a service owner may not know a dependency is there until the vendor says so. For PHP inside a vendor appliance or package, the operator has to wait for that vendor's update.

Supported branches are the second. The fixed releases cover the 8.2 to 8.5 branches, and CISA describes PHP 8.1 and earlier as unsupported. For a system still on one of those branches, the fix is a migration, not a patch, and a migration does not happen in an afternoon.

Change control is the third. Approvals, testing and supplier contracts are built for planned work. Taking a service offline turns an unknown exposure into a known outage the organisation controls, and the restore can wait until someone has checked what is running.

The cost is real: citizens lose access to services. Speed is the other pressure. The Minister told the Lords that “The NCSC was briefed by OpenAI last week on this potential specific vulnerability”, and said that “frontier AI allows for the identification of vulnerabilities”, which “means we need to be more vigilant and quicker in readying ourselves to apply patches and other mitigations.” If discovery keeps speeding up, the bottleneck is the time public IT needs to get from an advisory to a verified fix.

What this article does not claim

• No confirmed compromise. The Minister said the Government was “not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities”. The Dutch item says there were “nog geen signalen dat de kwetsbaarheden actief misbruikt worden” (no signs yet that the vulnerabilities are being actively exploited).
• No exploitation listing. When this article was checked on 25 October 2026, CISA's Known Exploited Vulnerabilities catalogue (version 2026.10.23) did not list CVE-2026-109618 or CVE-2026-109619.
• No percentage. No official source gives the share of public servers or sites that went offline, so none is given here.
• No judgment on the bodies named. Going offline was the step the agencies recommended.

Checklist for operators

• Inventory every PHP runtime, including PHP embedded in vendor products, appliances and admin interfaces, and ask each vendor for its status in writing.
• Record the PHP branch of each system. Anything on 8.1 or earlier needs a migration plan and, until then, an isolation plan.
• Decide in advance which services may go offline, who takes that decision, and how users are told and served in the meantime.
• Where a service has internal users, consider isolating it from public networks, as the EU statement suggests, rather than switching it off entirely.
• Before restoring, confirm the version the live service is actually running, not only what the package manager reports. Mitigate, then restore, in that order.
• Log when each service went offline and when it came back. That gap is your real patch pace.

Related reading

• PHP patching playbook: two unauthenticated RCEs fixed in October 2026

Questions to ask this week

• Which of our public services run PHP, including inside products we buy?
• Which of them are on PHP 8.1 or earlier, and who owns the migration?
• If an agency told us tomorrow to take PHP systems offline, who would decide, and within how many hours?
• How did we verify the running version before the last restore?

The agencies gave public bodies two options this week, patch or pull the plug, and several chose the second. The useful question is how long your own organisation would need to make the first one possible.

If you want to discuss how patch pace and controlled shutdowns work in your own systems, the contact page is open. In the message, mention this article and the system you have in mind, without credentials or confidential operational details.

• Request a technical review

Source registry

Sources consulted on 25 October 2026. Quotes are taken from the documents as published.

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026, revised 23 October 2026)
• ENISA: Joint statement on critical PHP vulnerabilities (21 October 2026)
• Rijksoverheid: Aantal websites Rijksoverheid preventief offline na kwetsbaarheden PHP (21 October 2026)
• Hansard, House of Lords: Cyber Security: PHP Vulnerability (22 October 2026)
• PHP: 2026 news archive, security advisory of 21 October 2026
• CISA: Known Exploited Vulnerabilities catalogue (JSON feed)