Note: This article explains a global website-security incident in plain language, based on statements from the PHP Foundation, security companies and government agencies. It is general information, not technical or security advice for any specific website.

PHP2Shell: The PHP Security Flaw Behind the Global Website Shutdowns — And What To Do Now

Published 22 October 2026 · Technology & Online Safety

Two critical security flaws in PHP — the programming language behind an estimated 70% of the world's websites — were made public on 21 October 2026, and the reaction was immediate: governments took official websites offline, major platforms went into emergency maintenance, and the US National Security Agency (NSA) issued a rare public warning telling organisations to patch at once or take vulnerable systems offline. Cyber experts have since reported a massive surge in hacking attempts against unpatched sites. The two flaws are known together as PHP2Shell.

What exactly is PHP2Shell?

PHP2Shell is the shared name for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both carry a severity score of 9.2 out of 10. According to the security agencies and researchers who disclosed them:

• An attacker can run code on a vulnerable web server without any password or login (remote code execution).
• The flaws can give a direct path to the server's file system and database, and can expose data held in server memory — which can include passwords and other sensitive information.
• The flaws have been sitting in PHP for years and affect versions going back to PHP 5.4, released in 2012.

A security engineer at the PHP Foundation described it as the most serious problem PHP has faced in more than a decade, comparing it to the Heartbleed crisis of 2014. The PHP Foundation's message to website owners was blunt: "If you run PHP, it is imperative that you update now."

How AI found the flaws

Unusually, these flaws were found with the help of advanced AI models, as part of OpenAI's "Patch the Planet" initiative, which pairs AI researchers with the volunteers who maintain widely used software:

• Researchers at the security firm Calif reported the first flaw on 11 August 2026, found using OpenAI's GPT-5.6 Sol model during an AI-assisted audit of PHP's code.
• Security firm Wiz (owned by Google's parent, Alphabet) independently found and reported the second flaw on 24 August, using models including Google's Gemini 4 Argon.
• The PHP team, OpenAI, Wiz and infrastructure providers such as Cloudflare then spent weeks preparing fixes in secret, so patches would be ready before the flaws became public.

Why everything happened at once this week

The public announcement was originally planned in an orderly way, but basic details of the flaws leaked on social media on 20 October — including a video showing how they could be exploited, which spread on hacking forums. That forced everyone's hand: the PHP Foundation brought the emergency release forward to 21 October, governments rushed to patch, and attackers began scanning the internet for sites that had not yet updated. That scanning is the "surge in hacking attempts" now being reported — which is why updating quickly matters so much.

Governments took websites offline as a precaution

Rather than risk running vulnerable systems, several governments briefly pulled websites offline while patching, including:

• Netherlands — the national digital identity system and parliamentary websites.
• Finland — central government services.
• France — prefecture websites.
• Germany — the digital ministry's websites.
• United Kingdom — including the Office for Budget Responsibility and NHS Scotland, with the UK's National Cyber Security Centre issuing similar patch-or-offline advice.
• Japan — major platforms such as niconico and pixiv entered emergency maintenance, and the Japanese government publicly urged prompt patching.

Going offline was a protective step, recommended by security agencies — it does not mean those websites were hacked.

Who is affected?

Any website that runs PHP on its own server or hosting account should be checked. That includes most sites built on WordPress, Drupal and similar systems, plus custom PHP websites and web applications. Sites on large managed platforms may already be patched centrally by the platform operator. The important dividing line is the PHP version:

What website owners should do now

• Check your PHP version in your hosting control panel (for example hPanel, cPanel or Plesk) or ask your hosting provider directly.
• Update PHP to one of the fixed versions above as soon as possible — take a full backup of the site and database first.
• If you cannot update yet, follow the NSA's advice seriously: consider taking the site offline temporarily rather than leaving a known-vulnerable server exposed.
• After updating, check the site works normally, and look for anything you did not change yourself — new admin accounts, altered pages or unknown files can be signs of an earlier break-in.
• Keep everything else current too — CMS core, plugins and themes — and turn on automatic updates where your host offers them.

Most reputable shared-hosting companies roll emergency PHP versions out across their servers quickly, but "the host probably handled it" is not a check — verify your own site's version.

What this means for ordinary internet users

If a government service, shop or news site you use is briefly offline or "under maintenance" this week, this incident is the likely reason — it is a precaution, not proof of a hack. You do not need to do anything about PHP yourself. Do stay alert for opportunistic scams: criminals often exploit big security news with fake "your account is at risk, log in here" messages. Only ever sign in through a service's official website or app, never through a link in an unexpected message.

Frequently asked questions

What is PHP2Shell?

It is the shared name for two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619), both rated 9.2/10, that can let an attacker run code on a vulnerable server without a password and reach its files and database.

Which PHP versions fix the flaw?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official fix.

Is my website affected?

If it runs PHP — as WordPress, Drupal and most website systems do — on a version older than the fixed releases, treat it as affected until updated. Check the version in your hosting panel or ask your host.

What should I do if I run a PHP website?

Back up, update PHP to a fixed version, verify the site, and review it for changes you did not make. If you cannot update immediately, the NSA advises taking the system offline until you can.

Were the government websites hacked?

There is no public indication of that. They were taken offline deliberately, as a precaution, while the emergency patches were applied.