This week, something unusual happened on the internet, and I am sure you noticed.
Services all over the world switched themselves off.
BambooHR took its HR platform offline in the US, Canada and Ireland. In the Netherlands, government portals, the parliament’s website and several education systems went dark, along with the national login many citizens use every day.
Many universities and companies turned some of their services off too.
All of them even without being hacked.
So what happened? Why did they do it?
Let’s take a look at it, because this one is particularly interesting!
What Is PHP?
Just in case you are not familiar with this term..
PHP is one of the languages that runs websites behind the scenes. Online shops, WordPress blogs, government portals, internal company apps. A huge share of the web runs on it.
What Happened
On October 21, two critical flaws in PHP were made public. Together they’re nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
The flaws can let an attacker run their own code on a server remotely, without logging in.
That might not be scary to you, but trust me, it is.
Think of it like this: Normally, you need a key to get into a building. This flaw is a door that opens for anyone who knocks the right way. No key, no password, no help from anyone inside.
In security, this is called unauthenticated remote code execution, and it’s probably the worst kind of vulnerability there is.
Why It’s Such a Big Deal
Three reasons why this turned a bad bug into a global fire drill:
It’s everywhere. National cyber agencies warned that organisations running any version of PHP are affected.
The details leaked early. A demonstration video was posted by mistake the evening before the fix was released. Attackers and defenders learned about it at the same time.
Attackers moved within minutes. Researchers saw exploitation attempts 19 minutes after the scheduled fix release.
Why Services Went Dark On Purpose
Security teams suddenly had two options:
Patch everything immediately: Easy to say, hard to do when PHP is hidden in hundreds of systems.
Isolate what they couldn’t patch yet: Take the service off the internet and keep it running only on the internal network, where attackers can’t reach it directly. That works for internal tools, but not for anything customers need to reach online.
Switch off what they couldn’t patch yet.
Going offline costs money and frustrates users. But a hacked server can cost far more: stolen data, ransomware, weeks of recovery.
So many organisations chose a few hours of downtime over a possible disaster. Simply because the possible losses were too high and too probable. And we all know how it works in risk management, right?
What Does It Mean for You?
If you’re an individual:
There’s not much you need to do. This flaw lives on servers, not on your laptop or phone.
If a service you use was offline this week, that was a good sign: they took security seriously.
Watch for phishing. Attackers love big news stories. Be careful with emails like “Security update required, log in here.”
If you run a business, or work in IT or security:
The approach is the same, whether you have one website or a thousand servers:
Find everything that runs PHP. Your own servers, but also your website, online shop, booking system and vendor appliances. Start with anything reachable from the internet.
Patch what you manage yourself to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
Ask your vendors about everything else. Web agencies, hosting providers, SaaS tools, managed services. Ask each one: “Are you affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and have you patched it?” Get the answer in writing, and keep asking until you have it. A vendor’s unpatched server is still your risk.
Can’t patch, and no answer yet? Isolate the system, or switch it off.
Check for signs of compromise, for example unusual processes started by PHP. Attackers may have gotten in before anyone patched.
The hardest step is almost always the first one. Many companies found PHP in places they had forgotten about: old servers, vendor appliances, side projects.
You can’t patch what you don’t know you have.
This is exactly when you start appreciating the asset management process everyone hated and tried to avoid for... forever.
Would you have made the right call? Let’s find out!
Patch, isolate or switch off. Security teams had minutes to decide this week. Questions like that are exactly what the CC and CISSP exams test.
Take the free CC Readiness Test to see if you’d make the right call!
Let’s Connect
If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:
Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap
Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!
Let’s learn and grow together!