Pull to refresh
Logo
PHP vulnerabilities exploited as websites worldwide go offline

PHP vulnerabilities exploited as websites worldwide go offline

New Capabilities

Security agencies urge immediate patching of flaws affecting up to 70% of the internet

Today: PHP releases patches; governments and companies take sites offline

Overview

Updated 44 minutes ago

On October 21, 2026, the PHP Foundation released patches for two critical vulnerabilities that let unauthenticated attackers run code on servers running PHP. The flaws, rated 9.2 out of 10 on the CVSS severity scale, affect nearly every PHP version released in the last decade.

Governments in Finland, the Netherlands, and Denmark, along with the BBC, Edinburgh council, and parts of Wikipedia, took websites offline as a precaution. Cybersecurity agencies in the US, Europe, Australia, Canada, Japan, and Britain urged organizations to patch immediately or take PHP-based systems offline. Cloudflare's chief technology officer said early attacks were emerging, though CISA had not observed exploitation as of publication.

Why it matters

Unpatched PHP servers let attackers take over websites and steal data — and PHP powers an estimated 70% of the internet.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

70%
Estimated share of internet affected
Wiz Research estimates PHP powers 70% of all websites; the BBC could not verify the figure.
9.2
CVSS v4.0 severity score
Rated critical, indicating unauthenticated remote code execution.
2
Critical vulnerabilities disclosed
CVE-2026-109618 and CVE-2026-109619, known collectively as php2shell.
Hundreds
Websites taken offline
Government sites, the BBC, Wikipedia pages, and others went dark as a precaution.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Organizations Involved

Timeline

August 2026 October 2026

3 events Latest: Today
  1. PHP releases patches; governments and companies take sites offline

    Today Response

    PHP released patched versions; Finnish, Dutch, and Danish agencies, the BBC, and others took websites offline as a precaution.

  2. PHP developers disclose two critical vulnerabilities, urge updates

    Disclosure

    PHP developers identified two critical vulnerabilities and urged users to update as soon as a fix was released.

  3. Calif and OpenAI report first PHP flaw to maintainers

    Discovery

    Security firm Calif, working with OpenAI, reported the first php2shell flaw to PHP maintainers.

Scenarios

1

Patch adoption contains the threat

Likely Resolves by Nov 21, 2026

Discussed by: CISA and national cybersecurity agencies

Organizations apply the patches released October 21, and internet-facing systems are updated within weeks. The coordinated disclosure, aided by AI-assisted discovery, gives defenders a head start.

2

Exploitation spreads to unpatched servers

Possible Resolves by Nov 21, 2026

Discussed by: Cloudflare CTO, Wiz Research

Attackers scan the internet for vulnerable PHP versions, targeting the estimated 70% of sites that run PHP. Early attacks were already emerging, according to Cloudflare's chief technology officer.

3

AI-assisted discovery finds more flaws

Possible Resolves by Jan 21, 2027

Discussed by: OpenAI, Wiz Research

The same AI-assisted techniques that found php2shell uncover additional critical vulnerabilities in PHP or other foundational software. OpenAI's Patch the Planet initiative continues to coordinate disclosures.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2021

Log4Shell (2021)

Researchers disclosed a critical remote code execution vulnerability in Log4j, a Java logging library used by millions of applications. Attackers could exploit it with a single crafted string, and scans for vulnerable systems began within hours.

Then

Organizations scrambled to patch, and the US government ordered federal agencies to fix the flaw within days.

Now

Log4Shell became a benchmark for critical software supply chain vulnerabilities, prompting new scrutiny of open-source dependencies.

Why this matters now

Like php2shell, Log4Shell affected a foundational piece of software used across the internet, forcing a global patching effort.

April 2014

Heartbleed (2014)

Researchers disclosed Heartbleed, a memory disclosure bug in OpenSSL, the encryption library used by most of the internet. Attackers could read sensitive data, including passwords and private keys, from vulnerable servers.

Then

Websites and services rushed to patch and revoke certificates, with major platforms updating within days.

Now

Heartbleed led to the creation of the Core Infrastructure Initiative to fund open-source security.

Why this matters now

Heartbleed showed how a single flaw in a widely used open-source component can expose a large share of the internet, a pattern php2shell repeats.

September 2014

Shellshock (2014)

Researchers disclosed Shellshock, a command injection vulnerability in Bash, the Unix shell. It affected millions of servers and devices, allowing remote attackers to execute commands.

Then

Organizations patched rapidly, but the flaw was found in many embedded devices that could not be easily updated.

Now

Shellshock highlighted the difficulty of securing software that is embedded in hardware and legacy systems.

Why this matters now

Shellshock, like php2shell, affected a foundational component of the internet and required urgent, global patching.

Sources

(10)