A critical PHP vulnerability set off precautionary shutdowns across government agencies and major online services in multiple countries, while Node.js and an eMudhra certificate issue surfaced at roughly the same time. For ordinary users, the problem sits on website servers rather than on personal devices, so there is generally no need to install extra software. The practical risk is different: users may run into outages, phishing attempts, fake update prompts and payment-page scams in the coming weeks.
Why PHP2Shell drew such a broad response
The report says the two bugs are collectively referred to as "PHP2Shell." PHP's official security advisory rated them critical, with a CVSS v4.0 score of 9.2 out of 10. The issue is a remote code execution flaw, meaning an attacker may be able to run code on a web server without logging in.
The weakness is in PHP itself, not in a plugin. That matters because platforms such as WordPress and Drupal run on PHP. Citing W3Techs, the report says about 70% of websites with a known server-side language use PHP. A patched release was published at nearly 10 p.m. on Oct. 21, but details had leaked the day before and attack tools were already circulating, leaving some operators with little time to patch before taking systems offline.
Government portals and major services went dark as a precaution
The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, advised organizations that could not update immediately, or were still using versions earlier than PHP 8.1, to take PHP systems offline. The U.K.'s National Cyber Security Centre and CERT-EU issued the same recommendation.
Japan Prime Minister Sanae Takaichi also posted on X on Oct. 21, saying that when immediate patching is difficult, "temporarily stopping websites" is one effective way to reduce risk.
According to a Reuters roundup cited in the report, many Dutch organizations followed guidance from the national cybersecurity center and went offline, including the Port of Rotterdam, the government portal Overheid.nl, the websites of five major political parties and several hospitals. DigiD, the country's digital identity login service, was also suspended. Germany's federal IT service provider ITZBund shut down several websites. France's Interior Ministry closed prefecture websites, while Belgium's foreign ministry, Finland's outward-facing government services and Czech government websites also went offline.
The Wikimedia Foundation, the parent organization behind Wikipedia, said all systems using PHP were affected and that some systems had been shut down.
Private-sector services were hit as well. Swiss hosting provider Cyon took down its customer portal, webmail and all hosted websites. 4chan and the esports wiki Liquipedia were also unreachable. In Japan, pixiv, niconico, the e-book store BOOK☆WALKER, and games including Pokemon Sleep and Uma Musume entered emergency maintenance. Most resumed by the early morning of Oct. 22. Nintendo also suspended some services.
Most of those shutdowns were described as precautionary. The report says many official statements said no intrusion had been found, and Finland said it had not detected attack attempts. In Taiwan, the Ministry of Digital Affairs' cybersecurity administration urged government bodies, schools and companies using PHP to confirm their versions and update as soon as possible early on Oct. 22.
Has the flaw been exploited yet? The answers differ
Views on active exploitation were mixed.
- Cloudflare's CTO said early attacks had been seen before the patch was released.
- Jake Knott of watchTowr said there had been attack attempts, adding, "So far no one has succeeded, but we do not think that will last very long."
- Patchstack said it had only seen reconnaissance-style probing.
- CISA said when it issued its alert that it had not yet observed exploitation.
- Sansec said it expected large-scale attacks to follow.
Five things users should watch for while browsing
WordPress plugin developer Meow Apps said that once a site is compromised, attackers often redirect visitors to scam pages. In some cases, the redirect is shown only to people arriving from Google or only to mobile users, which means site operators may not see it themselves. The report says the risk does not end on the day a patch is released, and lists five habits users should keep over the next few weeks.
1. Do not click "urgent update" or "reset password" links in emails
blue News warned that scammers are likely to use headlines like these for phishing. Emails asking users to install an "urgent security update" should be deleted. CISA also said that if a password needs to be changed, users should open the official website or app themselves rather than follow a link in an email.
The report adds that hosting providers may still send legitimate progress updates, so the safer approach is simple: do not click the link in the message, and log in through the official site on your own.
2. If a familiar site is down, wait for an official notice and do not search for an "alternative URL"
If a frequently used site cannot be reached, the article advises waiting for the operator's official announcement instead of hunting for backup links through search engines, where spoofed pages may appear.
3. Close any page that asks you to download a "browser update" or paste commands
Common tricks include fake browser-update notices, fake "verify you are human" prompts that ask users to paste commands, and swapped-out payment pages. The report says these tactics have not been confirmed as part of this incident, but visitors have fallen for similar attacks before. It cites the PEPE meme coin website as a past case where wallet-draining code was inserted.
4. On unfamiliar small online stores, use a credit card with instant transaction alerts or a third-party payment service
Sansec said e-commerce sites built on platforms such as WooCommerce are still within the risk range even if their own code is not the source of the problem. The report recommends using payment methods with real-time notifications and checking statements closely over the next few weeks.
5. Turn on two-factor authentication for important accounts and use a different strong password for each one
Cybersecurity firm Wiz demonstrated that even without gaining code execution, it is possible to read the memory of a PHP process. That memory may contain passwords, login tokens and API keys. In other words, unpatched websites may expose user credentials.
CISA recommends enabling two-factor authentication on important accounts and using different passwords for each account. blue News also said that if a service later announces a data leak, users should change that account's password immediately.
What exchange and wallet users should keep in mind
The report says there are currently no reports of exchanges or wallets being compromised through PHP2Shell. Kraken and Ledger have not been reported as hacked in connection with the issue.
Still, it gives several practical suggestions: open exchange websites from bookmarks rather than search results or ads; set IP allowlists on API keys and disable withdrawal permissions; and verify destination addresses on a hardware wallet screen before sending funds.
For users running their own trading bots, the article also recommends updating Python certifi and Node.js. Researcher Scott Helme said his testing found that curl, Python, Node, Go and Java all accepted a forged Stripe API certificate.