Explainer

Why did so many European websites go dark at once?

AI-generated text and synthetic voice. How this text is made

Early Wednesday, details of two flaws leaked on a hacker forum, and governments and hospitals went dark. In Rotterdam, the port and the RET transport operator were offline. In Antwerp, hospital websites were too.

Rotterdam and Antwerp

Rotterdam and Antwerp

Each flaw was rated 9.2 out of ten. They let criminals run their own code on a server from a distance, which could hand over full control of a website or access to customer data.

9.2

severity rating, out of tenSource: The Next Web · 21.10.2026

There was no update to install yet, and the flaw appeared to have been exploited for hours before the fix arrived in the afternoon. The PHP Foundation was blunt: There are no complete mitigations, updating is the only safe choice.

“There are no complete mitigations, updating is the only safe choice.”

PHP Foundation

Watch the explainer

Synthetic voice (AI)

The story

PHP2Shell flaws prompt website shutdowns worldwide as attackers tried exploits days earlierRead the article

Based on reports by

List of sources