Two critical bugs in PHP, the programming language behind most of the web, let an attacker take over a web server without logging in. PHP shipped fixes on Wednesday, October 21. Installing them is the job of whoever runs the server, usually a web host. The people who visit a site have nothing to install.
That is why parts of the web went quiet this week. The flaws, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, sit in PHP itself rather than in any one website’s code. So a WordPress blog, an online store and a government portal can all be exposed at once if nobody has updated the server underneath.
Why some sites went dark on Wednesday
PHP is everywhere. According to W3Techs, 69.3% of websites whose server-side language the survey can identify run on it. That includes every site built on WordPress.
Some sites broke or went offline on Wednesday. The Verge reported major issues at 4chan, DeviantArt and Wikipedia, and said some Dutch and Finnish government agencies took sites down as a precaution. The Record counted “hundreds” of sites offline and named Nintendo among companies that pulled services.
Governments encouraged that caution. The NSA’s advisory says that if “an immediate update is not feasible,” organizations should take the system offline until they can fix it. It also notes the bugs are “flaws in PHP itself, not in the hosted application or its configuration.” The UK’s National Cyber Security Centre gave the same advice.
The PHP security team rates both bugs 9.2 out of 10 on the CVSS v4 scale. Its security announcement says the two bugs “can allow unauthenticated remote code execution.” In plain terms, a stranger can make the server run their own commands without a password.
Attackers were probing servers before the fix shipped
The release came a day early. The PHP Foundation says it had planned to publish on October 22. Then the two CVE numbers began circulating online around 15:00 UTC on October 20, so the team moved the release to 14:00 UTC (10 a.m. ET) the next day.
Some attackers appear to have had a head start. Amazon’s security chief CJ Moses wrote that Amazon’s decoy servers caught a PHP2Shell attempt on October 17, four days before disclosure. In the same post, Amazon said the bug was “now being broadly exploited in the wild.” Cloudflare’s chief technology officer, Dane Knecht, said the company was “seeing early attacks emerging,” according to Tenable.
Not every company saw the same thing. The security firm Huntress said at 4:30 p.m. ET on Wednesday that it had not observed exploitation on its customers’ systems. That gap probably reflects who each company watches, not whether attacks are real.
AI also played a part in the discovery. The security firms Calif and Wiz and the AI company OpenAI found the bugs.
In its Patch the Planet post, OpenAI says Calif found one flaw using OpenAI’s GPT-5.6 Sol model. It calls PHP2Shell “one of the most impactful security issues in recent memory.” Wiz says it used Google’s Gemini 4 Argon and GPT-5.6 Sol. It adds that every PHP version from the past decade has at least one of the bugs.
Calif’s own writeup says it confirmed attacks that need no login against specific versions of WordPress, Drupal, Joomla, Magento, MediaWiki and Nextcloud.
What PHP2Shell means for you as a visitor
You don’t need to update anything on your phone or laptop. PHP runs on the web server, not in your browser. Malwarebytes also points out that a maintenance page doesn’t mean hackers got in. More likely, someone is installing the patch.
The real risk sits on the server side. The NSA says a successful attacker could “steal sensitive data, disrupt services, or move deeper into a network.” For a visitor, that means the account details, order history or saved addresses a site keeps about you. An attacker could also plant malicious downloads or redirects on a site you trust.
Malwarebytes’ advice is to leave any familiar page that suddenly asks you to log in again, pushes a download or sends you somewhere unexpected.
The usual habits do the most good. A different password for every site, plus two-factor login wherever a site offers it, means one breached store can’t unlock your email or bank. If a site you use later announces a breach, change that password first.
Your web host usually has to apply the fix
Who has to act depends on what your site runs on. The Verge says Squarespace and Wix sites are in the clear, because those platforms don’t support PHP.
Owners on shared or managed WordPress hosting rely on the host to update PHP on its servers. GoDaddy says any site using PHP should assume it is affected, according to The Verge. Anyone running their own server has to patch it themselves.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older sites have a harder road. PHP 8.1 and older no longer get official releases. The PHP team published do-it-yourself source patches for versions 7.4 through 8.1, and versions 5.4 through 7.3 get no fix at all.
That gap is large. W3Techs counts 26.9% of PHP sites on version 7 and 7.7% on version 5. Taken together, more than a third of PHP sites run version 7 or older, and none of those versions has an official fixed release. Some Linux vendors do backport fixes for older versions, so those owners should ask their vendor or host.
Check your site in three steps
Our own checklist, built from the PHP, NSA and Amazon guidance:
- Find out who runs PHP for you. On Squarespace or Wix, you have nothing to do. On a hosting plan, the host updates PHP. On your own server, you do.
- Look up your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Compare it with 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions often backport fixes without changing the number, so if yours looks lower, ask your host before you panic.
- Get the fix confirmed in writing, and cover the gap. Ask your host to confirm the patched build is live. Until then, Cloudflare’s firewall rules block known attack patterns for sites behind it, even on free plans. Cloudflare says to keep them on while patching, not instead of it. If you can’t patch, follow the NSA and take the site offline. Amazon also advises checking your server logs back to October 17, not just from the disclosure date.
The pressure won’t ease soon. AI agents have already tried to break into a Canadian government website, and browser makers this week blocked eMudhra’s certificates over a separate security failure. OpenAI says PHP2Shell is one of several major bugs it is working to fix. It expects similar findings to “increase sharply in the coming months.”
Sites that patch this week aren’t finished, either. PHP says version 8.2 reaches end of life on December 31, 2026. Anyone on that branch has about ten weeks to move to 8.3 or newer.
