We analyzed this claim: is it true that

precautionary shutdowns during the PHP2Shell crisis caused measurable interruptions to commercial transactions and essential public services even where no cyberattack was confirmed?

When Safety Shut Down the WebAI generatedConfirmed

records confirm extensive service interruptions including blocked orders, payroll delays and suspended emergency alerts, though no reliable total financial loss or count of prevented attacks has been established

Economy

When Safety Shut Down the Web

Precautionary shutdowns during the PHP security crisis disrupted everyday services before any cyberattack was confirmed.

Published
NRB — News Republic Brigade

Other links

PHP Security TeamLogiusSoftBank

The story continues

In a nutshell

When dangerous coding flaws surfaced in PHP software on October 21, 2026, companies and government agencies around the world intentionally disconnected their own systems to keep attackers out before official fixes were ready. The move prevented potential intrusions, but the self-imposed shutdowns froze business orders, stalled payroll tools, disabled municipal portals and halted mobile emergency alerts. While the protective steps succeeded in blocking unauthorized access, they created widespread public disruptions whose total financial and human cost remains unmeasured.

Highlights

  • Downtime alerts recorded by monitoring service UptimeRobot spiked to roughly 37,000 per minute on October 21.
  • Japan's telephone relay service for people with hearing or speech difficulties was suspended for about 23 hours.
  • Japanese supermarket chain Every announced a 5% discount across 48 stores to compensate customers for broken payment apps.
  • Tracked services faced a median outage duration of 10 hours and 56 minutes during the precautionary response.

Monitored Outage Recovery Status as of October 24

StatusMonitored Services
Recovered101
Not Yet Confirmed Recovered73
  • Recovery classifications reported by an outage tracker covering 174 monitored services as of October 24.
  • Shows that more than two-fifths of tracked services remained unconfirmed even after official software repairs became available.

From the Editor’s Diary

Disconnecting systems before a cyberattack occurs removes the danger of digital intrusion, but it shifts the damage onto everyday operations. The true test of digital defense is whether shutting the door costs more than the risk of leaving it unlocked.

Who's involved

  • PHP Security Team

    The group that maintains PHP, the code powering web pages

    goal → Deliver working security repairs and advice without exposing systems to intruders

  • Logius

    The Dutch government office running national digital identity services

    goal → Keep public login systems working while shielding state networks from flaws

  • SoftBank

    A Japanese mobile phone network provider

    goal → Protect internal systems while keeping disaster warnings flowing to phones

  • B-Cart

    A Japanese online service for business-to-business purchasing

    goal → Keep business orders moving without leaving customer accounts exposed

  • BambooHR

    An American maker of online payroll and workplace software

    goal → Shield worker records without stopping daily payroll and staff management

  • NTT Docomo

    A Japanese mobile telecommunications provider

    goal → Safeguard internal servers while preserving primary earthquake warnings

  • Every

    A Japanese chain running 48 grocery stores

    goal → Keep supermarket checkout apps running and compensate shoppers for disrupted perks

  • National cybersecurity authorities

    State agencies that advise the public on digital safety

    goal → Help organizations balance security shutdowns against the need to stay online

In short

Organizations around the world took down their own websites and digital networks on October 21, 2026, cutting off ordinary public and business services to prevent attacks from two critical flaws in PHP, the common code that runs web pages.

This choice makes clear that companies will face pressure to publish full records of lost sales, blocked payroll and interrupted public safety tools to determine whether these self-imposed outages cost more than the risks they avoided.

Whether that accounting happens is too early to tell because operators have not released internal financial, transaction and recovery records.

Previously in this story

How it unfolded

01

A Security Alert Forces a Difficult Choice

2026-10-20 – 2026-10-20

The emergency began on October 20 when the PHP maintainers warned that two critical flaws beneath millions of websites required an urgent software release the next afternoon. Security manager Jakub Zelenka sent the alert to the official community mailing list at 19:33:47 UTC. Technical notes had escaped early, leaving operators to decide whether to stay online with open weaknesses or cut connections before an official repair arrived. German hosting provider dataforest posted the first known warning at 01:56 UTC on October 21.

1 source
02

Systems Go Dark Before Repairs Arrive

2026-10-20 – 2026-10-21

Hours before security repairs were ready, organizations began disconnecting systems on their own. British digital authorities noted that taking networks offline was a reasonable move if quick protection was impossible. The Dutch government pulled public sites down, and commercial services took similar steps before fixes appeared at 14:00 UTC. This wave of closures shows how the earliest losses came from self-defense rather than confirmed intruders, making an outcome of heavy disruption unavoidable.

6 sources
03

Inaccessible Pages Did Not Always Stop Services

2026-10-21 – 2026-10-22

A missing web page did not always mean a stopped service. When the public site for DigiD, the Dutch online identity portal, went dark, its actual login tool kept working behind the scenes. In France, hosting firm Scaleway suspended its account dashboard but left customer servers running. The distinction altered the meaning of the event: closing an informational page caused minor inconvenience, while stopping an underlying tool broke actual operations, showing that damage cannot be measured simply by counting missing websites.

5 sources
04

Commerce Pauses and Real Costs Appear

2026-10-21 – 2026-10-22

Other shutdowns halted everyday commerce directly. FormMailer stopped accepting submissions in Japan for about six hours. Ordering system B-Cart turned off its store interfaces for eleven hours, leaving downstream retail merchants like Public Shoji unable to receive orders. In the United States, BambooHR disconnected its workplace platform, delaying human resources and payroll tasks. Even as fixes rolled out, companies kept systems closed for internal testing, proving that protective measures carried tangible business consequences.

6 sources
05

Public Services Face the Toll of Caution

2026-10-22 – 2026-10-23

The consequences soon reached basic municipal and personal services. Osaka suspended online citizen portals for childcare, park maintenance and dementia support. Japan's telephone relay service, which helps people with hearing or speech difficulties place phone calls through interpreters, halted standard smartphone and sign-language connections for roughly 23 hours. Regional utility Kyushu Electric Power kept its outage map offline. These suspensions showed that protective shutdowns prevented residents from handling essential daily affairs, heightening the urgency for clear accounting.

6 sources
06

Emergency Warnings Pause While Stores Offer Discounts

2026-10-23 – 2026-10-24

The deepest disruption hit disaster alerts as operators dealt with another complex software risk. SoftBank paused mobile warning texts for earthquakes and tsunamis across its networks, while NTT Docomo halted government evacuation alerts. Meanwhile, Japanese supermarket chain Every faced days without its phone payment app and promised a 5% discount across 48 stores to compensate shoppers. This concrete compensation showed commercial costs taking direct form, even as the broader financial total remained uncalculated.

6 sources

Where things stand

As of October 25, 2026, investigations confirm that protective shutdowns caused widespread disruptions that often lasted longer than the time needed to release software fixes. An outage log recorded 174 affected web services by October 24, noting 101 restored and 73 still offline, with a typical shutdown lasting 10 hours and 56 minutes. These figures describe specific monitored services rather than a complete worldwide count.

No reliable worldwide total exists for lost business revenue, delayed payroll transactions, failed alert deliveries or prevented attacks. Determining whether the safety measures were worth the disruption will require organizations to release detailed records of failed transactions, public service delays and true recovery expenses. Key milestones to watch include SoftBank's planned return on October 26, NTT Docomo's alert restoration, and Every's supermarket compensation program.

PHP2Shell: the PHP security crisis

Open the dashboard →

Sources