Governments, universities and well-known websites pulled services offline on 21 October 2026 after two critical flaws surfaced in PHP, the language that runs a large share of the web. The bugs, nicknamed PHP2Shell, let an attacker run code on a server without logging in. Patches are out, but the story is not over, and anyone who runs a PHP site, including WordPress, should check their version now.
What was found
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS v4.0 scale and allow unauthenticated remote code execution. PHP's developers say all installations serving web requests are potentially affected, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed. They consider the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
According to TechCrunch, security researchers at Calif found the bugs and alerted the PHP Foundation, which began a period of fixing and coordinated disclosure. OpenAI has said an OpenAI model helped Calif identify one of the flaws and that Wiz independently reported both. We covered that angle in our earlier article on OpenAI's Patch the Planet initiative.
Why websites went dark
Details leaked a day before the planned 22 October disclosure, so PHP moved its fix forward to 14:00 UTC on 21 October. Security firm watchTowr then reported active exploitation attempts against both flaws. TechCrunch reports there was some exploitation before patches were public, and that the PHP Foundation blamed one company for pushing patches live hours before the embargo ended.
CERT-EU advised organisations that could not patch immediately to isolate internet-facing applications. The Dutch parliament and national cyber agency websites, Finnish government services and several university sites went offline as a precaution, according to The Register and other outlets. NBC News reported that Pinboard, parts of Wikipedia, 4chan and Something Awful were also briefly down. Axios reported that the US National Security Agency told operators without time to patch to take sites down.
What to patch
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end of life and no longer receive regular updates, though PHP has provided limited source-code fixes for 7.4, 8.0 and 8.1 for teams that build PHP themselves.
- Shared hosting or managed WordPress: ask your host whether PHP has been patched. GoDaddy, for example, said it patched all PHP versions across its hosting products within about a day.
- Your own server: update through your operating system's package manager, or install one of the fixed releases directly.
- Old PHP versions: plan an upgrade to a supported release rather than relying on a one-off fix.
The Hacker News reports a stop-gap for one flaw where patching is delayed: set session.upload_progress.enabled to 0 and restart all workers, with an extra setting on PHP 8.5. Treat that as temporary and follow PHP's official advisory.
A third flaw is still open
On 23 October, PHP disclosed a separate vulnerability, CVE-2026-115560, which was not yet patched. PHP plans to fix it in its next routine release, so keep an eye on updates in the coming days.
Why it matters
Many small business and school sites, including across Africa, run on inexpensive shared hosting where the owner does not control the PHP version. If you manage such a site, message your host today and ask for the PHP version and patch status in writing. As of publication, watchTowr and Cloudflare reported attempted exploitation, and no confirmed breaches had been reported in the sources reviewed.
Sources: The Register, TechCrunch, The Hacker News, NBC News, Axios, GoDaddy, University of Washington IT.
