Cloudflare reports millions of PHP2Shell exploit attempts

On the evening of October 21, government agencies and other organizations across several countries took their websites offline, according to a report by Geek Park. The sites affected included government portals as well as hospitals, ports and political parties in Finland, the Netherlands, France and Germany, among others. The report links the shutdowns to two PHP vulnerabilities collectively called PHP2Shell, which could allow an attacker to take remote control of a server without logging in.

According to the report, the Finnish government shut down all of its external online services. The Netherlands' national cybersecurity center took down its own website, and the Port of Rotterdam, the Dutch football association, five major political parties and several hospitals followed. France's interior ministry told provincial government websites to go offline temporarily, while Germany's federal IT service provider closed multiple sites. Belgium's foreign ministry, the Wikimedia Foundation and Nintendo also suspended some services. The report stresses that the sites were not breached; they were taken down voluntarily, and the Dutch government described the removal of sites including DigiD as a precautionary measure.

The report notes that PHP is the most widely used server-side language for websites, and that about 70% of sites whose backend language can be identified run on it, citing W3Techs statistics. The two vulnerabilities were first found by AI. According to the report, this is the first publicly reported case in which a vulnerability discovered by AI led multiple countries to shut down websites on the same day. At the time of the report, the situation stood at the stage of organizations voluntarily taking services offline; the material does not mention when the vulnerabilities will be fixed or when the sites will return.