Crypto outlet Coin Bureau has warned that the Internet is going into a lockdown. Two critical flaws in PHP, the programming language behind a large share of the web, put millions of websites at potential risk of cyberattack. The outlet said governments, banks and major platforms have already taken sites offline, and that many are calling the episode 'Black October'.
Millions of websites exposed
Coin Bureau said the flaws, dubbed PHP2Shell, let hackers break into servers without a password and are each rated 9.2 out of 10 for severity. It noted that PHP runs roughly seven in ten websites. Security firms confirm this. W3Techs data puts PHP at about 69-70 percent of websites whose server-side language is known.
The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and were disclosed by researchers from Wiz, OpenAI and Calif. According to security firm Imperva, they involve how PHP handles memory exhaustion, and successful exploitation can lead to full remote code execution without authentication. They are believed to affect versions going back to PHP 5.4.
Governments, banks and platforms go offline
Cybersecurity agencies in several countries have urged PHP site owners to patch immediately or take sites offline. CERT-EU advised organisations that could not install the fixes to pull affected sites down, according to BigGo Finance. Dutch and Finnish government sites were among those taken offline. Japan's banks also went offline. Nintendo and the Internet Archive were reported to have taken services down as well.
Timeline of the scramble
Coin Bureau said details began circulating on October 20 and emergency fixes arrived the next day, but attackers were already moving. CNBC reported the patches were meant to ship on Thursday but were fast-tracked after the bugs leaked and Calif accidentally posted a proof-of-concept video. The PHP Foundation released fixes on Wednesday, October 21.
Millions of attack attempts
Coin Bureau cited Cloudflare chief executive Matthew Prince as saying hacking attempts jumped from thousands to millions within hours. Prince has said on X that Cloudflare saw thou`sands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes afterwards, and millions soon after.
Coin Bureau also noted that Cloudflare says hackers are tweaking their attacks to slip past its protections. Cloudflare has said request-based rules alone are not a substitute for patching.
No confirmed breach yet, but some attacks may go unseen
Coin Bureau warned that CrowdStrike says such attacks leave almost no trace, so some sites may not know if they have been hit. Officials, however, have so far reported no confirmed successful intrusions. According to The Next Web, German, Dutch and Japanese officials said none of the attempts they had seen had worked. Germany's cyber agency, the BSI, said it had seen attacks but no successful use of the flaws. Cryptopolitan reported the PHP Foundation says it knows of no successful code execution.
Security firm watchTowr, however, said it has observed exploitation in the wild, which means attacks beyond mere scanning have been recorded.
Old versions the biggest worry
Coin Bureau said around 2.6 million internet-facing servers run PHP, potentially hosting hundreds of sites each, and that over 1.1 million use older versions that no longer receive official updates. Other estimates differ. CybelAngel counted about 2.24 million internet-facing PHP hosts, with 59 per cent of those reporting a version on branches getting no official fix. Palo Alto Networks put the number of potentially exposed instances at more than 22.6 million.
Coin Bureau also stressed that patching does not remove a backdoor an attacker may already have planted. Older installations, it said, may need an upgrade to a supported version or a fix from their software provider.
