Why is this website down for maintenance? Emergency patching explained

WindowsMaciPhoneAndroidUpdated

On 21 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) said organisations that can't update PHP straight away, or still use PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated." Taking a site offline until it can be updated is one reason it may show a maintenance page. This guide is accurate as of 23 October 2026.

Quick answer

After two critical PHP flaws were announced on 21 October 2026, security agencies in the UK, US and Japan told organisations to update PHP, and to consider taking systems offline if they couldn't. A maintenance page may mean the owner is doing that work. Wait, check the site's official channels, and don't enter details on lookalike pages.

Why do websites go into maintenance after a security advisory?

Because fixing the problem means changing software on the server, and a server that can't be fixed quickly may be safer switched off. PHP is the language many websites run on, and the PHP project released fixed versions on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory says only an update is a complete solution. Our hub guide, PHP2Shell explained, covers the flaws themselves, and what is PHP? explains why a server-side bug touches so many sites.

Updating isn't always a quick job. Japan's Information-technology Promotion Agency (IPA) points out that systems which haven't been updated for a long time may need changes to the website's own code and fresh testing, and can be held up by missing documentation, staff who have moved on or expired maintenance contracts. While that happens, a maintenance page is often the visible sign.

What did the official agencies advise?

All four agencies below put updating first. Where they differ is on what to do if that can't happen straight away.

  • NCSC (UK). The National Cyber Security Centre tells organisations to update PHP, internet-facing systems first. If they can't, the PHP Foundation has published temporary mitigations. If those can't be applied, or would take too long, the NCSC says "you should consider taking the system offline until it can be fully mitigated."
  • CISA (US). Patch immediately. Organisations that can't, or that run PHP 8.1 or earlier, should take PHP systems offline until they're patched or updated.
  • JPCERT/CC (Japan). Its alert of 22 October says JPCERT/CC has confirmed PHP is widely used in Japan, and asks anyone running affected versions to apply the fix promptly, after enough testing, and to check whether their systems were compromised.
  • IPA (Japan). Its alert of 22 October says not to leave a vulnerable system running while an update is pending. Organisations should put interim measures and access restrictions in place, and if effective interim measures are hard to achieve, decide whether to block access from outside or temporarily stop the service, weighing the possible damage against the effect on their business.

What should I do if a site I use is down for maintenance?

Mostly, wait. The fix is the site owner's job, and nothing you install on your own phone or computer will fix a website's server.

  1. Check the site's official channels for a status update, such as its verified social media accounts, an app you already use, or an email you were expecting. IPA asks organisations to plan how they tell users about alternatives while a service is changed or withdrawn, so a notice may appear there.
  2. If you need to reach the company, use contact details you already trust. The NCSC's advice for suspicious messages is to contact the organisation directly using the details from its official website, not the ones in the message.
  3. Come back to the site by typing its address or using your own bookmark, rather than a link someone sent you.

Should I be careful of lookalike pages while a site is offline?

Yes. The NCSC says "Many scammers operate fake websites" that are designed to steal passwords or other personal information, and that criminals often use current news stories to make a scam seem more relevant. A message saying a site you use has moved, or asking you to log in somewhere else "while maintenance is happening", deserves suspicion.

Don't enter a password, card number or personal details on a page you reached from an unexpected email, text or advert. If you've already done so, the NCSC's phishing pages explain what to do next, and you can report a suspicious website to the NCSC for free.

Does "down for maintenance" mean the site was hacked?

Not necessarily. A maintenance page tells you the site is unavailable, not why. The advisories above ask organisations to take systems offline when they can't update them, so a maintenance page can simply mean that work is under way.

If a company finds that customers' personal data was affected, that's a separate matter with its own steps. Our guide is my personal data at risk from the PHP vulnerability? explains how you'd normally find out and what's worth doing in the meantime.

Why is it taking so long to come back?

Some owners can update in minutes and some can't. IPA's alert describes the harder cases: old systems where updating PHP means reworking and retesting the site, and organisations that have to find the people, budget and support to keep it maintained. It tells those that can't secure that support to consider moving to a supported product or service, reducing what the site offers, or ending publication altogether. So a few sites may come back looking different, and some may not return.

Banking apps down on 20 October 2026? The Google Cloud outage guide explains what Google says happened and what to do when your bank's app is down.

More questions

Is it safe to visit a website that's back after maintenance?

The PHP flaws are in the server's software, not in your device. For the wider question, our guide can visiting a hacked website hack you? explains what a compromised site could do to visitors and what to watch for.

Has anyone exploited the PHP flaws?

CISA says in its alert of 21 October 2026, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". As of 23 October 2026, none of the four agency alerts used for this guide reports a number of affected websites.

What is "emergency maintenance"?

The phrase isn't used in the official PHP advisories; it's the site owner's own wording. The work the NCSC, CISA and IPA describe for PHP is updating the software, or taking a system offline until it can be updated.

Why does PHP maintenance affect so many different sites?

Because many sites run on the same PHP software. The NCSC says "Organisations using any version of PHP are affected", and CISA notes that PHP is often a component of other software, so even sites that don't mention PHP may need work.

Should I change my password for a site that went down?

There's no general instruction to do so because a site went offline. If the company tells you there was a problem with your account, follow its instructions through its official channels.

Sources