PHP to Motoko
Menu

Research & advisories

Read the original sources.

Start with PHP’s release guidance, then read the research and response from security agencies and the wider community. Each entry links to its publisher.

PHP2Shell / 21 October 2026

Patch today.
Reassess the stack.

9.2severity out of 10, for both bugs

0logins needed to run code on the server

5.4+unpatched PHP releases since 5.4 affected

PHP2Shell is one urgent example of a continuing responsibility: keeping your PHP runtime, frameworks, plugins and dependencies current. Apply the security releases now. Then evaluate which services could be rebuilt to reduce the PHP stack your team has to maintain.

See the reported precautionary shutdowns

The runtime question extends beyond PHP. Node.js also released high-severity security fixes on 21 October 2026, including a Brotli decoder flaw permitting remote code execution. Updates are available for its 22.x, 24.x and 26.x release lines. See the official Node.js advisory and TechCrunch’s wider security roundup.

Still running PHP? Find your fix.

Update to

8.5.12

Patch the existing deployment first. Migration is a separate architectural decision, with its own assessment and validation.

FBI Cyber Division guidance recommends taking affected systems offline until mitigated when immediate patching isn’t possible.

Read PHP’s advisory

Reported impact / 21 October 2026

Taken offline.
As a precaution.

Public portals and supporting services were taken offline while operators prepared or applied PHP updates. Four documented examples:

Netherlands01 / Public portal

MijnOverheid

Government services

The government portal was temporarily taken offline as a precaution, according to the Dutch government.

Government statement
Netherlands02 / Public website

DigiD

Website and sign-in are distinct

The public website went offline. DigiD sign-in remained available at other services, according to Logius.

ANP interview with Logius
Netherlands03 / Public agency

NCSC.NL

National Cyber Security Centre

The agency said it temporarily took its own website offline as a precaution while responding to the PHP vulnerabilities.

NCSC’s own notice
Worldwide04 / Supporting services

Wikimedia

Toolforge & Cloud VPS

Wikimedia said it deliberately took supporting services offline until they could be safely patched.

Wikimedia’s own statement

Precautionary downtime does not by itself establish a breach. These organizations are news subjects; no endorsement or migration to ICP is implied.

See all 13 reported examples

The Dutch judiciary also reported precautionary shutdowns. Links above lead to reporting or the organization’s own notice from 21 October 2026.

What happens inside PHP?

Fatal error: Allowed memory size of 134217728 bytes exhausted

In the demonstrated Apache mod_php attack, exhausting memory during request startup leaves invalid state that cleanup later processes, enabling code execution without logging in.

The advisories, straight from the source.

Start with the patch, the research and the response. Explore all 38 publications from PHP’s maintainers, government security agencies and the security community below.

Show all 38Hide the directoryPublishers, research & official advisories

Published on 20 and 21 October 2026. Some were written before the patches shipped, so check each one for updates.

Separate the response from the architecture decision.

Use the advisories to address the current deployment. Evaluate a migration separately against your application requirements and the behavior your team can verify.

Evaluate the operating model