ShadowGraph
Free alerts
Research · Case study · frozen snapshot

PHP2Shell: who went offline?

On 21 October 2026 two critical PHP flaws (CVE-2026-109618, CVE-2026-109619, “PHP2Shell”) were disclosed: remote code execution on any PHP installation that serves web requests. National agencies advised taking systems that could not be patched immediately offline. This is what 3,207 sites on our radar looked like that day.

Event
21 Oct 2026
Sites monitored
3,207
Outages analysed
132
Snapshot
22 Oct 2026, 07:50 UTC
Long outages · 21 Oct173+31% vs the 7-day average of 132
Peak hour · 13:00 UTC5.8×33 new outages, usual 5.7
Visible PHP · affected / comparison53% / 26%odds ratio 3.1, one-sided Fisher p = 2.4e-5
Still down next morning26affected sites that did not answer at 07:50 UTC on 22 Oct
01

When it happened

New outages of 30 minutes or more per hour (UTC) on 21 October, against the average hour of the seven days before.

21 Octoberaverage hour, 14–20 October

Day (UTC)Outages ≥ 30 minOutages ≥ 2 h
2026-10-1413869
2026-10-1511845
2026-10-1611848
2026-10-1716293
2026-10-18185118
2026-10-1913273
2026-10-207033
2026-10-2117398

18 October also had many long outages, mostly on a few large consumer sites, so the daily count alone is not unusual. What stands out on 21 October is the hour pattern and who was affected.

02

Whole networks, not single sites

The radar opens a network incident only when several independent sites in one network fail in the same sweeps. These are the incidents it opened on 21 October without being told what to look for.

NetworkWhat it isOpened (UTC)Closed (UTC)Sites failingSites at risk
SURFDutch research and education network21 Oct 10:4722 Oct 07:4638
DFNGerman research network21 Oct 13:1621 Oct 17:36821
BelnetBelgian research and government network21 Oct 14:1122 Oct 00:1132
SWITCHSwiss research network21 Oct 14:3221 Oct 15:2235
mittwaldGerman PHP-focused web hoster21 Oct 14:3221 Oct 20:4630
OVHcloudEuropean cloud and web hoster (3 short incidents)21 Oct 14:4621 Oct 16:31731
GARRItalian research network21 Oct 19:1621 Oct 19:2135

Five of the seven are national research and education networks. Universities in Germany, the Netherlands, Belgium and Switzerland widely run PHP content management systems such as TYPO3 and Drupal.

03

Did the affected sites run PHP?

On the morning of 22 October we read the public homepage of every affected site and of a comparison group of 140 sites from the same catalogue lists that had no outage. We looked for visible signs of PHP: CMS generator tags, WordPress paths, the PHPSESSID cookie and the X-Powered-By header. A site without a visible sign may still run PHP, so both shares are lower bounds.

Visible technologyAffected sitesComparison group
TYPO3172
WordPress1924
Drupal144
Joomla11
Magento01
Other PHP evidence (session cookie, header)53
Any visible PHP56 of 106 · 53%35 of 133 · 26%
95% interval (Wilson)43.4–62.1%19.6–34.4%
Not readable at the time of the check267

Association found Affected sites were about three times as likely to show PHP (odds ratio 3.1, one-sided Fisher exact test p = 2.4e-5). TYPO3 stands out: 17 affected sites against 2 in the comparison group.

04

Universities and public bodies

57 of the 132 affected sites belong to universities, research institutes or public authorities. “Unreachable” means the site still did not answer when we fingerprinted it the next morning.

SiteDown from (UTC)DurationErrorVisible technology
archives-ouvertes.fr21 Oct 00:528 h 15 mintimeoutunreachable
autoriteitpersoonsgegevens.nl21 Oct 10:0721 h 5 min+, still downfetch failedunreachable
belgium.be21 Oct 14:0610 h 5 minHTTP 503Drupal
brandenburg.de21 Oct 16:1214 h 45 minHTTP 503WordPress
bundesumweltministerium.de21 Oct 10:327 h 20 minHTTP 503TYPO3
charite.de21 Oct 08:1210 h 55 mintimeoutTYPO3
cnil.fr21 Oct 10:1221 h+, still downHTTP 503unreachable
cnr.it21 Oct 15:222 h 55 minfetch failedDrupal
daad.de21 Oct 13:563 h 15 minHTTP 503no PHP signal
denic.de21 Oct 12:4718 h 25 min+, still downfetch failedunreachable
elte.hu21 Oct 15:121 h 15 mintimeoutDrupal
epfl.ch21 Oct 13:4117 h 30 min+, still downfetch failedunreachable
eur.nl21 Oct 11:3119 h 40 min+, still downtimeoutDrupal
europa.eu21 Oct 06:411 h 35 mintimeoutDrupal
fes.de21 Oct 13:563 hfetch failedTYPO3
fgov.be21 Oct 14:0610 h 5 minHTTP 503Drupal
finna.fi21 Oct 11:063 h 35 minHTTP 503PHP (session cookie)
grnet.gr21 Oct 13:5117 h 20 min+, still downfetch failedunreachable
hu-berlin.de21 Oct 13:311 h 20 mintimeoutno PHP signal
inra.fr21 Oct 15:261 h 10 mintimeoutDrupal
inrae.fr21 Oct 15:311 h 5 mintimeoutDrupal
ki.se21 Oct 07:2210 h 35 minHTTP 503Drupal
krakow.pl21 Oct 12:1119 h+, still downtimeoutunreachable
leidenuniv.nl21 Oct 09:1621 h 55 min+, still downtimeoutunreachable
meteofrance.com21 Oct 14:222 h 20 mintimeoutDrupal
overheid.nl21 Oct 09:511 h 25 mintimeoutDrupal
rivm.nl21 Oct 10:5620 h 15 min+, still downfetch failedunreachable
rki.de21 Oct 10:223 h 40 mintimeoutno PHP signal
ru.nl21 Oct 10:411 h 15 minfetch failedDrupal
ruhr-uni-bochum.de21 Oct 10:322 h 45 mintimeoutWordPress
tu-bs.de21 Oct 13:074 htimeoutTYPO3
tu-chemnitz.de21 Oct 13:3717 h 35 min+, still downtimeoutunreachable
tu-dortmund.de21 Oct 09:4616 h 35 minHTTP 503TYPO3
tu-dresden.de21 Oct 13:5130 mintimeoutno PHP signal
tudelft.nl21 Oct 11:3119 h 20 mintimeoutTYPO3
tue.nl21 Oct 09:5616 h 30 mintimeoutTYPO3
tuwien.ac.at21 Oct 14:222 h 20 minHTTP 503TYPO3
u-bordeaux.fr21 Oct 16:1215 h+, still downtimeoutunreachable
uclouvain.be21 Oct 14:3155 minHTTP 500Drupal
ugent.be21 Oct 13:4117 h 30 min+, still downtimeoutunreachable
um.es21 Oct 18:5611 h 40 minHTTP 502no PHP signal
uni-bayreuth.de21 Oct 11:1618 h 15 mintimeoutno PHP signal
uni-due.de21 Oct 12:0719 h 5 min+, still downtimeoutunreachable
uni-halle.de21 Oct 12:074 h 15 mintimeoutno PHP signal
uni-heidelberg.de21 Oct 10:262 h 5 minfetch failedno PHP signal
uni-jena.de21 Oct 13:311 h 45 minfetch failedno PHP signal
uni-muenster.de21 Oct 13:1116 h 10 mintimeoutunreachable
uni-osnabrueck.de21 Oct 14:022 h 40 mintimeoutTYPO3
uni-paderborn.de21 Oct 11:2245 minfetch failedTYPO3
uni-tuebingen.de21 Oct 11:315 h 40 mintimeoutTYPO3
uni-wuerzburg.de21 Oct 11:565 h 40 mintimeoutTYPO3
unibas.ch21 Oct 14:2655 mintimeoutunreachable
unicaen.fr21 Oct 11:064 h 25 mintimeoutWordPress
unige.ch21 Oct 13:5117 h 20 min+, still downHTTP 503unreachable
unipd.it21 Oct 14:1716 h 55 min+, still downtimeoutunreachable
univie.ac.at21 Oct 07:421 hHTTP 501TYPO3
vie-publique.fr21 Oct 12:3216 h 15 minHTTP 503no PHP signal
05

What this does not show

The limits are part of the result.

  • No proof of cause. We see that sites stopped answering, not why. Patching, deliberate shutdowns, firewall rules and unrelated faults all look the same from outside.
  • Sector confound. Universities and public bodies use TYPO3 and Drupal more than the average site, so part of the PHP difference reflects who was affected rather than what they run.
  • One vantage point. Our checks run from AWS in North America. A European site that blocked traffic from outside Europe as a quick mitigation looks like an outage to us.
  • Fingerprint after the fact. The technology check ran on 22 October. 26 affected sites were still not answering and could not be classified.
  • Background noise. Roughly 130 long outages happen on an ordinary day. The 132 affected sites include ordinary ones, for example a short Bitbucket incident.
06

Data

129 of the 132 affected sites with start, recovery, duration, error and the technology fingerprint, as CSV under CC BY 4.0. 3 adult sites are counted in all figures but not listed by name. The numbers on this page are frozen and will not change.

Method: HTTPS reachability checks every five minutes; an outage is two or more consecutive failed checks, counted here when it lasted 30 minutes or more and started on 21 October (UTC). Vulnerability sources: CISA alert of 21 October 2026, Help Net Security, Sansec, Google Cloud.