21 October 2026 · 4 min read · Marketing Scan
Editorially updated:
This article was translated from Dutch.
Short answer: usually not. Take your site offline only if it runs vulnerable PHP, handles sensitive data and cannot be updated within a day or two. Otherwise, promptly updating to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is better.
On 21 October 2026, Smartschool, DPG Media, FPS Finance, hospitals including UZ Gent, UZA and AZ Oostende, Flemish government websites and VRT went offline as a precaution against php2shell. Should you follow? Here is how to choose.
Not because they were hacked. On 21 October, the CCB reported no confirmed successful Belgian attacks, according to VRT NWS. It was precautionary, as Techpulse also describes.
These organisations often have many websites and systems processing student, patient or tax information. Checking and updating everything takes time. Going offline quickly removed risk while checks continued. A small business with a single site can often solve it with an update.
Consider taking it offline or using a maintenance page if at least a situation below applies:
Stay online in these circumstances:
A brochure site without forms has lower risk, but is not safe. Attackers can alter it, redirect visitors or misuse the server. Updating remains necessary. Check PHP usage with the free Marketing Scan PHP check if unsure.
A WordPress maintenance plugin displays a tidy notice, but itself uses PHP. Every request still passes through vulnerable PHP, so it offers little protection against this flaw.
To really go offline, ask for a server-level static page without PHP. Use status code 503 so search engines understand the outage is temporary.
You lose contact enquiries, shop orders and Google visitors. Going offline is a temporary emergency measure rather than a solution. Agree who restores the site and when: once PHP has been updated and checked.
Partly. Cloudflare observed initial attempts and deployed extra rules, reports VRT NWS. A firewall can slow attacks, but Patchstack identifies updating as the only complete solution.
Usually not. It makes sense when the site runs vulnerable PHP, handles sensitive data and cannot be updated within a day or two.
As a precaution. Large organisations handling sensitive data across many systems went offline while checking. On 21 October 2026, the CCB still reported no successful Belgian attacks.
Hardly. A maintenance plugin itself uses PHP, leaving vulnerable PHP running. A server-level static page does protect.
Until server PHP is updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and your developer has checked for intrusions.
No. Shopify manages servers; you have no PHP installation to update. Your shop need not go offline.
How does a marketing scan work? Audit methodology
Create a free account. Save your website in your dashboard and follow its score and improvements in one place.
Create your free accountTwo critical PHP vulnerabilities let attackers take over websites. Here is what to arrange today, even if you have no technical knowledge yourself.
· 4 min read
Updated:
Ready-to-copy emails about the PHP vulnerability for your host, developer and follow-up, plus how to recognise whether their answer is specific enough.
· 4 min read
Updated:
Find out in four steps whether your website is vulnerable to the October 2026 PHP flaw, without technical knowledge and without putting your site at risk.
· 4 min read
Updated:
WooCommerce, PrestaShop and Magento use PHP. Protect customer data and payments after php2shell and understand when a personal-data breach must be reported.
· 4 min read
Updated:
Shopify moved its AI knowledge base into the admin. Check published store facts, return policies and migration before January 15, 2027 with this checklist.
· 4 min read
Google Tag Manager without jargon: understand tags and triggers, set up GTM for your small business and correctly connect your cookie banner to your tags.
· 7 min read
Updated: