On 21 October 2026 NÚKIB recommended a quick PHP update because of two critical vulnerabilities; the Office of the Government and the Czech Hydrometeorological Institute temporarily took some websites offline.
On 21 October 2026 the National Cyber and Information Security Agency (NÚKIB) recommended that operators of websites and services using the PHP programming language update immediately. The reason is two critical vulnerabilities, collectively called php2shell, which allow an attacker to run their own code on a server remotely without logging in. Fixes and the information needed to exploit the flaws are publicly available. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.[1][2][3]
Developers were informed of the flaws on 20 October 2026, and reports of attempts to exploit them followed. According to Lupa.cz, they were discovered by the security company Wiz, and the flaws had been hidden in the code for more than ten years.[1][3]
The Úřad vlády České republiky temporarily took its website offline as a precaution on 21 October 2026 at 19:00 so that security fixes could be applied. The Czech Hydrometeorological Institute also temporarily took some of its websites out of service, for example hydro.chmi.cz. According to the Reuters agency, government offices in Germany, France, the Netherlands and Finland had acted similarly earlier.[1][2][3]
Related articles: PHP
Chronology
- — The National Cyber and Information Security Agency advised operators of websites running PHP to update quickly because of critical vulnerabilities, and the Úřad vlády České republiky took its websites offline. ČTK / České noviny Hospodářské noviny
Sources
- ČTK / České noviny — 21 October 2026
- Hospodářské noviny — 21 October 2026
- Lupa.cz — 21 October 2026