Some public institutions in Japan and Northern Europe temporarily shut down their websites because of two critical vulnerabilities in the PHP programming language known as “PHP2Shell.” Japan’s Ministry of Health, Labour and Welfare suspended the website of an information system for long-term care service providers as a precautionary measure.
Some public institutions in Denmark, Norway, Finland and the Netherlands also partially or completely halted access to their websites. Cybersecurity agencies in the Scandinavian countries called on system owners to install updates as soon as possible and, if that was not possible, to take their websites offline.
U.S. calls for systems to be taken offline
In its warning on October 21, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, enabled remote code execution without authentication. CISA called for systems to be upgraded to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and for systems to be taken offline if this could not be done. The FBI also recommended shutting down systems until they could be made fully secure if an update could not be installed immediately.
European agencies also issue warnings
Germany’s Federal Office for Information Security (BSI) recommended considering disconnecting vulnerable servers that could not be patched immediately from the internet. The EU’s cybersecurity unit CERT-EU said technical details about the vulnerabilities and proof-of-concept code had begun circulating, increasing the possibility of exploitation. CISA noted that it had not yet observed the vulnerabilities being exploited when the warning was issued.
