When a widely used platform discloses a critical vulnerability, the immediate aftermath can be as disruptive as the flaw itself. New data from website monitoring service Oh Dear quantifies just how chaotic the hours following the October PHP vulnerability disclosure were for site owners and their users.
More than 40 hours later, the share of sites down was still more than twice the level measured a week earlier.
Taking a site offline while you patch is often the right decision. We wanted to show what that decision looks like when thousands of teams make it in the same afternoon.”— Mattias Geniar, Founder
Between 14:30 and 15:00 UTC on 21 October 2026, a striking 18.8% of websites under Oh Dear’s monitoring were unreachable. During the identical half-hour window seven days prior, that figure sat at just 0.9%. The dramatic surge came right after the public release of details on two PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.
According to Oh Dear’s analysis published on 22 October, the spike was largely driven by PHP site administrators deliberately taking their applications offline while they awaited security patches. Oh Dear’s monitoring continues to run during scheduled maintenance windows, and any site meeting its failed-check threshold is counted as down in the data.
For those wanting to dig into the numbers, the complete charts, half-hourly breakdowns, and the detailed methodology are available in the October incident section of Oh Dear’s uptime statistics page. The dataset spans tens of thousands of sites with HTTP checks running from 20 to 23 October, with a direct comparison against the same hours from the prior week.
A slow return to normal
The recovery was far from instant. Five hours after the initial peak, 8.9% of monitored sites were still offline. By 07:30 UTC on 23 October — a full 41 hours after the incident began — the rate had dropped to 2%, though that was still more than double the 0.9% baseline recorded at that same time the week before. It’s worth noting that each of these figures represents a single half-hour snapshot, and the specific sites experiencing outages varied at each measurement point.
Looking at the broader three-day window, 11.3% of monitored sites experienced an outage lasting between 4 and 12 hours. In the comparison week, a mere 0.1% of sites saw similar disruption.
One telling detail emerged from the data: at the peak of the incident, 43.4% of the downed sites were returning HTTP 503 status codes, a sharp rise from the 7.7% observed before the event. While 503 responses are commonly associated with maintenance pages, Oh Dear cautions that the code alone doesn’t reveal the underlying reason a site was offline, nor does it confirm whether the downtime was intentional.
Earlier research on ordinary outages
This October event stands in stark contrast to typical outage patterns. In June, Oh Dear published research on 1,817,403 confirmed outages recorded between March and December 2025. That study found half of all outages ended within two minutes, with a median duration of just 1.9 minutes. While that June median reflects individual outage lengths, the October figures measure the percentage of monitored sites down within a single half-hour block.
Methodology
The sample includes every site with an active HTTP uptime check between 20 October at 09:00 UTC and 23 October at 08:00 UTC. A site is classified as down in a given half hour if at least half of its checks fail during that period. The baseline comparison uses the same hours from 13 to 16 October. Planned maintenance counts as downtime when checks fail. It’s important to note that a majority of Oh Dear’s monitored sites run on PHP, and this data is not representative of all websites or even all PHP websites globally.
About Oh Dear
Oh Dear provides health monitoring for websites, checking uptime every minute alongside SSL certificates, DNS records, domains, cron jobs, broken links, performance metrics, and overall application health. The service offers actionable alerts and branded status pages to keep users informed.
Deian Isac
Oh Dear
+34 676 55 22 59
Visit us on social media:
LinkedIn
Facebook
YouTube
X
Other
Why it matters: This incident highlights a critical tension in security response: taking systems offline to patch them can create massive availability problems of its own. For IT teams, the data underscores the importance of having rapid patching procedures and communication plans in place before a vulnerability announcement forces thousands of simultaneous decisions.
