The PHP Flaw That Shook the Internet: Does It Affect Your Site?

Two flaws in PHP, the language behind up to 70% of websites, forced governments and major sites offline on 21 October, and this article explains what happened, why it matters, how to fix it and how to check whether your own site is exposed.

On 21 October, the Dutch national cyber agency took its own website offline. Finland pulled government web services the same day, the UK’s Office for Budget Responsibility went dark, and Wikipedia’s operator shut down some of its systems. At that point nobody had been hacked. The shutdowns were a precaution against two flaws in PHP, the language behind up to 70% of the world’s websites.

What happened

Researchers at Wiz, Calif and OpenAI each found the flaws independently, using AI models to dig through code that human reviewers had missed for more than ten years. The two bugs, CVE-2026-109618 and CVE-2026-109619, are nicknamed PHP2Shell and both score 9.2 out of 10 for severity. Left unfixed, they would let a stranger take control of a server without a password, read the data stored on it or plant malware.

The fix was due later that week. Then details leaked on 20 October, and PHP rushed out updates on the 21st. Cloudflare said attacks were already reaching its customers. The FBI and NSA told organisations that could not update quickly to switch their sites off until they could.

Why it matters

Website owners will find this awkward: the flaw is not in your website at all. It sits in PHP, the software underneath WordPress, Drupal, Magento and Joomla, so updating your theme or plugins changes nothing. Someone has to update PHP on the server itself.

The 70% figure is the share of sites that use PHP. Only those running an unfixed version are at risk. Visitors can keep browsing as normal. What is exposed is the data a site holds, such as customer names, email addresses and logins.

Old sites are the bigger problem. PHP released fixes only for versions 8.2 to 8.5, and one analysis before the release put 59% of internet-facing PHP servers on versions that will never get an official fix. Plenty of them belong to businesses that have forgotten they exist: a campaign microsite from 2019, an old customer portal, a staging server nobody switched off. For a site that old, a website revamp is often cheaper and safer than trying to keep it patched.

What businesses should do now

• Make a list of every PHP site you run or depend on, including ones an agency or vendor manages for you.
• Ask your developer or host which PHP version each one uses and whether it has been updated since 21 October.
• Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Sites on 8.1 or older need a vendor patch or a proper upgrade, which is a good moment to rethink your website development setup rather than patch it again next year.
• A firewall such as Cloudflare’s can block known attacks in the meantime, but it does not replace the update.
• If you cannot patch soon, taking the site offline is a legitimate choice. Write the holding message now: what is affected, why, and when you expect to be back. Your internal communication team should brief staff before customers start asking questions.
• Once you have updated, ask your security team to read the server logs from before the update. Patching shuts the door but does not remove anyone who got in earlier.

What the expert says

“In 14 years of building and running web applications, I’ve learned that the bug is rarely the hard part. PHP2Shell joins a long line of critical flaws, like Heartbleed, Shellshock and Log4Shell, found deep inside software everyone trusts. With PHP2Shell, the fix arrived within hours, and our team had every affected site assessed and patched or mitigated within two days. What made that possible was knowing exactly what we run, where it runs, and who owns each server. My advice is simple: treat upgrades as part of the job, not something for later. Security debt stays invisible until a critical vulnerability arrives.”

— Sanjeev Kumar, AGM, Software Engineer, TIC

How to check whether your website is exposed

Start by finding out whether your site uses PHP at all. A site built on Java, .NET, Node.js or a hosted builder is most likely unaffected. If nobody on your team knows, ask whoever built it.

On WordPress, go to Tools, then Site Health, open the Info tab and look under Server. The PHP version is listed there. On other setups, check the hosting control panel for a PHP version setting, or ask your host to confirm it in writing.

Then compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or anything higher. If you are on 8.1 or older, there is no official patch.

Point to note: One catch trips people up. PHP has to be restarted after the update, otherwise the old version keeps running. Ask your host whether that has been done, whether any of your sites are on an older version, and whether anyone has checked the logs from before the update.