Why School, Hospital and Government Websites Went Dark This Week, and What to Do About Yours

On Wednesday, websites for schools, hospitals and government offices across Europe and Canada started going offline. They hadn't been hacked. Their IT teams were racing to fix a flaw in the software that quietly runs a large part of the web. If your organization's site went down this week, or you're wondering whether it should have, here's what happened in plain terms and how to think through your options.

1. What Happened

PHP is the programming language behind a huge share of websites. It runs WordPress, Drupal, Joomla and plenty of other systems, including some you might not realize use it. Two serious flaws were found in PHP itself, nicknamed "PHP2Shell." Both are rated 9.2 out of 10 for severity.

• What an attacker can do: Run their own commands on a web server without logging in. No stolen password needed. From there, an attacker could steal data, change what your website shows, or leave a back door to come back later.
• Why the timing made it worse: Word of the flaws leaked online on Tuesday, October 20, a day before the planned fix. The PHP team released patched versions on Wednesday, October 21. Amazon's security team later reported spotting an attempt to use the flaw four days before the fix was public, and says the flaws are now being broadly exploited.
• What the authorities said: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately. For anyone who couldn't update right away, or who runs older, unsupported versions of PHP, CISA's advice was to take those systems offline until they're fixed. Canada's national cyber security agency gave similar guidance, and some Government of Canada websites were taken down as a precaution.

2. Why This One Is Different

Most website security news involves a single plugin or a weak password. This one sits underneath everything.

• Your website software can't protect you: A fully updated WordPress site with a good security plugin was still exposed, because the problem is in the engine, not the car. Updating WordPress is not the same as updating PHP.
• It can strike before your site even loads: In some server setups, the attack can run before your website's own code, including its login page and security tools, ever loads.
• Your data is on the line: Your website may collect enrollment forms, appointment requests or resident information. A compromised server can expose that data, send visitors to scam pages, or get your site flagged as unsafe. For healthcare organizations, a breach involving patient information can also trigger HIPAA notification requirements.

3. Your Options, Walked Through

Not every site is in the same position. Here's how we'd sort it.

• Your site is current and your host has patched: Good news, but don't stop there. Get written confirmation from your host or IT team that the PHP fix is installed, not just scheduled. Then have someone check for signs of tampering, like unfamiliar files or new admin accounts, since attack attempts were spotted before the fix was public.
• Your site runs on older software: The official fixes were released for PHP 8.2 and newer. Versions 8.1 and older no longer get routine security updates from the PHP project, so they need either a fix from your hosting vendor or an upgrade. Upgrading PHP usually means updating WordPress, your theme and your plugins too, so everything still works together. It's more work, but it's the path that actually closes the hole. Done right, it happens on a test copy first, so the live site comes back clean and working.
• You can't upgrade right away: Keeping the site offline is the safest holding pattern, and it's what CISA recommends. Firewall services from providers like Cloudflare and AWS can block known attack patterns and buy some time. But Cloudflare's own CTO called firewall protection a stopgap, and Amazon says upgrading is the only complete fix.
• You bring it back as is: It's an option, but an honest one comes with a warning. An unpatched server stays exposed to an attack that is already circulating. If your site shares a server with others, the risk doesn't stay contained to you.

4. Our Recommendation

For most organizations, the right path is clear: update or upgrade, check for tampering, then relaunch. A few days offline is frustrating. A compromised site that leaks parent or patient information is far worse, and much harder to undo.

• Ask your team: Which version of PHP are we running, and has the fix actually been installed?
• Ask your team: When was our site last fully updated, and who is responsible for keeping it current?

If those don't have quick answers, that's useful to know now rather than during the next emergency.

Why Work with SunNet?

Our team has been working with clients since the news broke: taking servers offline, reviewing sites, and planning upgrades for older builds. If your site needs a PHP or WordPress upgrade, we can scope the work, test it on a staging copy, and bring your site back online safely.

Events like this are a good reminder that a website needs ongoing care, not just a launch day. The good news is that this is fixable, and you don't have to sort it out alone.

Not sure where your website stands? Reach out to our team and we'll take a look.

Summary

Two critical flaws in PHP, known as PHP2Shell, let attackers take over web servers without logging in. Agencies including CISA urged organizations to patch immediately or take vulnerable sites offline. Sites on current versions of PHP can be patched quickly, while older sites need an upgrade to be fully protected.

Key Takeaways

• PHP2Shell affects PHP itself, so updating WordPress or plugins alone does not fix it.
• Fixes are available for PHP 8.2 and newer. Older versions need a vendor fix or an upgrade.
• If you can't update right away, keeping the site offline is the safest option.
• Firewall protection can buy time, but it is not a complete fix.
• Check for signs of tampering, since attack attempts began before the fix was public.

Sources

1. CISA: Critical Vulnerabilities in PHP Require Immediate Patching
2. PHP Security Advisory: RCE via OOM corruption (CVE-2026-109618)
3. PHP Security Advisory: RCE via stale global state (CVE-2026-109619)
4. Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure
5. Malwarebytes: Why websites are going offline for emergency security updates
6. Canadian Centre for Cyber Security: Statement on critical vulnerabilities in PHP
7. Reuters: Governments, companies take websites offline over PHP flaws