On October 21, government portals, news sites and crypto-related pages across Europe went dark within hours of each other. No hack took them down. Their own admins pulled the plug, on purpose, because of two critical bugs in PHP nicknamed PHP2Shell. This one hit close to home for me. I am Dutch, I have a DigiD, and I have family in Denmark, so both headlines landed in my group chats before they landed in the news. In this post I explain what happened, what did not happen, and why every airdrop farmer should tighten up this week.
What Is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution. In plain English: an attacker can send a crafted request to a vulnerable server and run their own code on it, without ever logging in. The PHP team rated both bugs 9.2 out of 10. Some security firms went straight to 10.
The flaws sat in PHP since version 5.4, which shipped in 2012. Nobody found them for over a decade. Then security researchers at Wiz used AI models to chain the steps together, and OpenAI says one of its models also helped surface one of the bugs. That is the part that worries me most. The barrier to finding this kind of bug just dropped.
Why does this matter so much? Roughly 70% of the web runs on PHP. WordPress alone powers around 40% of all websites. Drupal, Joomla and Magento run on it too. One bug in PHP is therefore a bug in millions of servers at once.
Patches landed on October 21 around 14:00 UTC, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, PHP 8.1 and older get no fix at all. Roughly half of all PHP sites run those older versions. Those sites remain exposed until someone migrates them.
Why DigiD, MijnOverheid and Other Sites Went Dark
The PHP team announced the bugs on October 20 and promised a patch the next day. Technical details then leaked early. Cloudflare saw the first attack attempts at 07:43 UTC on October 21, before the fix existed. At that point, CERT-EU and national cyber agencies gave blunt advice: patch immediately, or take the site offline until you can.
Organisations listened. In the Netherlands, the login service DigiD and the citizen portal MijnOverheid went offline. So did the Dutch parliament site, RTL, Tweakers, the Port of Rotterdam and even the Dutch cyber agency’s own website. Finland’s state IT provider took government services down. Belgium’s cybersecurity centre went offline too. Nintendo and Wikimedia pulled systems as well.
Here is the important bit. DigiD was not hacked. The Dutch cyber agency saw no active abuse, and the responsible minister confirmed no signs of misuse. My own DigiD still works for logging in elsewhere. Only the digid.nl website itself went dark for a while. Taking a site offline is the safest move when you cannot patch in time. It is a precaution, not a breach. Anyone telling you DigiD “got compromised” is spreading panic, not news.
The Danish Story Is a Different Breach
Denmark did have a serious incident this month, but it has nothing to do with PHP. In early October, Danish authorities revealed that 8.8 million records from the CPR register, the national person registry, were stolen back in September. The data included full names, addresses, CPR numbers, birth dates and marital status. That covers around 80% of everyone in the system.
The entry point was embarrassing. A small vendor with access to the registry had leaked credentials, and reportedly several of its accounts used the password “123456”. One of them was an administrator account. My family in Denmark is in that database, like almost everyone else in the country. Absurd does not begin to describe it. A national registry with 11 million records, protected by the first password every brute-force tool tries. Authorities revoked the access and opened a full investigation.
MitID, the Danish digital ID, was not breached. Officials confirmed the stolen data alone cannot bypass MitID’s two-factor login. On October 21, the Danish municipal IT company Kombit did pull a few services offline because of PHP2Shell, including a school platform. That was the same precaution as everywhere else.
So we have two separate stories. One is a decade-old PHP bug with a global precautionary shutdown. The other is a Danish data theft through weak vendor passwords. Both are bad. Mixing them up helps nobody.
Why This Matters for Crypto Users
You might think a PHP bug is a problem for governments and news sites. It is also a crypto problem, for three reasons.
First, a huge share of crypto project websites run on WordPress. Think of landing pages, docs sites, blogs, airdrop claim pages and NFT mint pages. If an attacker takes over one of those servers, they can swap the real claim button for a wallet drainer. The URL stays correct. The logo stays correct. Only the script behind the button changes. I covered exactly how those drainers work in my guide on how to avoid drainer scams.
Second, phishing waves always follow big security news. Expect emails and DMs that say “Your account needs a security update after the PHP incident. Verify here.” Exchanges and wallets do not work like that. Scammers also sent fake support mails after past incidents, as I showed in the post on phishing tactics targeting Ledger users.
Third, the Danish data theft hands criminals a full profile of nearly every Dane, including my relatives. A scammer who knows your name, address and birth date sounds very convincing on the phone. I have already told my family to hang up on any unexpected “bank” call and ring the bank back on the official number. Danish crypto users should do the same with every “exchange” call for a while.
What I Am Doing With My Wallets This Week
I run more than 100 wallets a year for airdrop farming, so a week like this is a good moment to slow down. I am not connecting my main wallets to any new site until the dust settles. New airdrop claims can wait a few days. Nobody ever missed an allocation because they claimed on Friday instead of Wednesday.
Additionally, I am checking that AirdropAlert itself runs a patched PHP version. WordPress auto-updates do not fix this, because the bug lives in the server software, not in a plugin. Every site owner needs to confirm with their host. If you run a project site, do that before anything else.
Checklist: Protect Yourself for the Next 72 Hours
Keep it simple. Here is what actually helps.
Pause new wallet connections. Use a fresh burner wallet with small funds if you must interact with something.
Type URLs yourself. Avoid links from Telegram, X replies and emails this week, even from accounts you trust. Our guide on how to claim crypto airdrops safely walks through the full routine.
Revoke old token approvals. Hardware wallets protect your keys, but approvals you signed months ago still work.
Ignore every “security update” message. Real exchanges push updates inside the app, never through a link in your inbox.
Watch the official channels of projects you farm. If a project site goes offline, that is probably a good sign. It means someone is patching.
Site owners: confirm your PHP version with your host. If you are on 8.1 or older, you need a migration, not a patch.
For the long version of all this, our Stay Safe page collects every security basic in one place.
Keep This Content Free
Verifying a story like this takes hours, especially when half of what circulates on X is wrong. Our independent coverage stays free thanks to the exchanges we partner with. If you want to support that work, sign up for OKX through our link or create a Bybit account via AirdropAlert. It costs you nothing and keeps the guides coming.
Final Words
PHP2Shell is one of the most severe web vulnerabilities in years, and the precautionary shutdowns were the right call. DigiD and MitID were not compromised. The Danish CPR leak is real but unrelated. For crypto users, the danger is not the bug itself. The danger is the wave of hijacked claim pages and phishing that follows it. Slow down this week, connect nothing you do not need to, and check your approvals. Then get back to farming. You can browse the latest airdrops once the patching dust settles.
FAQ
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow attackers to run code on a web server without logging in. Both scored 9.2 on the CVSS scale.
Was DigiD hacked?
No. DigiD and MijnOverheid went offline on October 21 as a precaution while the PHP patch was pending. Dutch authorities reported no signs of abuse.
Was MitID compromised?
No. Denmark suffered a separate theft of 8.8 million CPR records in September through a vendor with leaked credentials. Officials confirmed that data cannot bypass MitID’s two-factor login.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fix. PHP 8.1 and older receive no patch and need a migration.
Is my crypto at risk from PHP2Shell?
Not directly. Your keys live in your wallet, not on a PHP server. The risk is hijacked project websites serving wallet drainers and the phishing wave that follows big security news.
What should airdrop farmers do right now?
Pause new wallet connections for a few days, revoke old approvals, type URLs manually and ignore any “security update” messages that arrive by email or DM.
Credit: Source link
