Full list of websites at risk of blackout as outage threatens 75% of internet

The internet could be grinding to a halt in front of our eyes as two critical vulnerabilities in the PHP (PHP Hypertext Preprocessor) programming language are being patched on October 21, 2026.

As PHP is used by up to 75% of websites on the World Wide Web, the fact that they could be exposed to security vulnerabilities has led to a number of sites going dark in anticipation.

PHP runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to our browsers.

The European Union Computer Emergency Response Team has reiterated that the risk scores of these vulnerabilities "indicate the potential for unauthenticated remote code execution," meaning hackers could install malware, swipe customer details, or even take down websites entirely as a major cybersecurity concern.

What is the PHP patch advice?

Some sites have taken themselves offline as a precaution (DIRK WAEM / Contributor / Getty)

In the United Kingdom, the National Cyber Security Centre is telling organizations to "take immediate action to mitigate a security issue affecting PHP." Organizations using PHP version 5 or later are encouraged to update to a fully supported version as soon as possible.

The NCSC told people to prioritize internet-facing systems, but as all versions can be affected, don't assume it's just outdated ones in the firing line.

You should also continue to monitor security updates from third-party software vendors and apply them as soon as they're available.

Importantly, we're reminded: "If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated."

UNILADTech was told that older sites are particularly at risk, with full-stack engineer David Erichsen explaining that most well-maintained sites on supported PHP versions should be fine within a few hours.

In terms of older sites, moving from PHP 7 to PHP 8 requires plugin updates and could mean they're dark for days or weeks. Erichsen clarified that sites that aren't updated could be attacked for years to come. He reminds us that the critical PHP flaw from 2024 was still being exploited around nine months after the patch.

What sites are affected by the PHP patch?

Although things are expected to return to normal, some older sites could be down for much longer (Surachai Chaikit / Getty)

Following on from this advice, Finland has temporarily shut down its public web services, and the Netherlands' cyber-security agency has taken its own website offline. The list extends to:

• Tweede Kamer (the lower house of the Dutch Parliament)
• MijnOverheid (The central Dutch government portal)
• The National Institute for Public Health and the Environment (The Dutch RIVM)
• AZ Monica Hospital in Antwerp
• KNMP (Pharmacists' umbrella organisation in the Netherlands).
• The Dutch police union ACP
• EBS (Dutch public transport operator)
• Smartschool (Belgium's primary school platform)
• Multiple official websites of the Flemish Government in Belgium

As reported by NBC, there's widespread concern as several Japanese websites covering daycare centers and video games are voluntarily coming offline.

Amid fears that hackers could take them offline, the bookmarking site Pinboard is down, as are some parts of Wikipedia.

The WikiTech site has a PSA that reads: "We are undertaking critical maintenance work due to an updated PHP release. Events are developing rapidly. This page will be updated as appropriate."

Erichsen similarly pointed to the following as likely targets:

• WordPress
• Drupal
• Joomla sites
• WooCommerce
• Magento stores
• Laravel apps
• cPanel and Plesk nd hosting control panels

While many of the above have been taken offline as a precaution, most are expected to come back online as hosting companies and system admins install the emergency PHP core updates.