PHP Website Shutdown Tracker

Sites that went offline because of PHP2Shell, the October 2026 PHP remote code execution flaws CVE-2026-109618 and CVE-2026-109619, and when they came back.

On 21 October 2026 at 14:00 UTC, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical flaws that allow unauthenticated remote code execution:

PHP says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php. PHP 8.1 and older get no official update, but the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1.

The PHP project announced the release on 20 October. The embargo leaked a day early and exploit claims spread on social media. A PHP release manager said that changing PHP settings will not stop the attacks. Cloudflare reported early attacks and deployed stopgap firewall rules.

CERT-EU, the cybersecurity team for the EU institutions, advised organizations that cannot patch at once to take internet-facing PHP applications off the network until a fix ships. Many operators did not wait for the patch. They took their PHP services offline. This page lists those sites, when a public source first reported them dark, and when they came back.

Background: The PHPocalypse is the second biggest story today.

All times are UTC. "Reported dark" is the time of the first public report, not the moment the site went offline. Each date links to its source. Aggregator reports are not confirmed at the original source.

Know a site that should be on this list, or one that is back? Open an issue. The raw data is in sites.csv.

Built and maintained by Luka Kladarić. Source on GitHub.