What happened on October 21
Governments and companies around the world pulled websites offline on October 21, 2026, after the maintainers of PHP, a programming language that runs a large share of the web, announced two critical security flaws. Cloudflare, a cloud services firm, said later that day it had seen millions of attempts to exploit them. The flaws are nicknamed PHP2Shell.
PHP’s maintainers warned on Tuesday evening that fixes would follow on Wednesday. They rate both flaws 9.2 out of 10 for severity, which counts as critical. Malwarebytes, a security company, says an attacker could run harmful code on an affected server without logging in. Updated versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released that day. Reuters reports the flaws sat in the software for years and were found using artificial intelligence (AI).
Millions of attempts, few confirmed breaches
Cloudflare chief executive Matthew Prince said in a post on X that, in the ten hours before the public announcement, the company’s network saw thousands of attempts to exploit the flaws. He said that rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by late Wednesday. These are Cloudflare’s own counts of attempts, not confirmed break-ins.
Jake Knott, head of threat intelligence at security firm watchTowr, said his company was also seeing attacks. Nobody had succeeded so far, he said, but he did not expect that to last.
Governments and companies react
Dozens of government agencies issued urgent warnings overnight, according to The Record, a cyber-security news site. The European Union, Germany, Japan, Australia, the United Kingdom and the Netherlands all published alerts. Reuters reports that Japan’s prime minister, Sanae Takaichi, urged website owners to check whether they use PHP, and that the finance ministry suspended some web content. Mitsubishi UFJ Financial Group, a Japanese lender, paused some internet services.
Why old servers worry experts
Malwarebytes notes that PHP 8.1 and older no longer get routine security updates, so some owners may have no official fix to install. Joviane Jardim, a senior security researcher at Detectify, told The Record that many organisations only learn about a forgotten PHP server when an attacker finds it.
Shahak Shalev of Malwarebytes called the situation a goldmine for hackers, because criminals could hijack trusted sites to phish people. Malwarebytes adds that a site being offline does not mean it was breached. It may simply be a precaution.
Our Analysis
This section is our own reading, not a finding from the sources. Governments reacted in different ways. Several issued written alerts, while Japan’s prime minister spoke publicly and some ministries closed pages. None of the reports we reviewed mention India’s national response team, so Indian site owners should not wait for a local notice.
Two gaps stand out. First, no source we opened counts sites actually hacked; Cloudflare’s figures measure attempts, and the only independent comment says none had worked yet. Second, taking a site down is a pause, not a cure. It helps only if an update exists, and owners on PHP 8.1 or older may have none. Exploit attempts also appeared before the patch, so defenders had hours, not days.
