PHP2Shell vulnerabilities trigger widespread web service shutdowns

Two critical security vulnerabilities in the PHP engine, collectively known as ‘PHP2Shell’, have prompted urgent warnings from cybersecurity authorities. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2, indicating an extremely high risk of unauthorized remote code execution on web servers without user intervention.

The German Federal Office for Information Security (BSI) has issued a Level 3 ‘Orange’ cybersecurity warning, noting that technical details leaked prior to the official release of security updates, granting attackers a significant head start. The vulnerabilities affect a wide range of PHP installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, impacting versions dating back to PHP 5.

In response to the threat, several major institutions, including the Charité hospital in Berlin, various universities, fire departments, and government agencies, were forced to take their websites offline as a precaution. While security updates have been available since October 21, 2026, the incident has highlighted the necessity for robust Business Continuity Management (BCM) to handle the operational impact of emergency IT shutdowns.