PHP, the programming language behind most of the web, released emergency security updates on 21 October 2026 for two critical flaws, and government websites across Europe and the United Kingdom went offline while their owners installed them. Amazon says the flaws are now being broadly exploited in the wild. Website owners need to update or ask their host to. Visitors can protect themselves with a few habits, and UtilForge has a free check for one of the tricks criminals use on hijacked websites.
By Lindsay McDonald, UtilForge spokesperson
Update, 24 October 2026. On 23 October 2026 the Cybersecurity and Infrastructure Security Agency updated its alert. It names the fixed releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says organisations still running PHP 8.1 or older, or unable to update straight away, should take those systems offline until they are updated. It adds a detection rule for security teams and points to matching alerts from the National Security Agency, the United Kingdom's National Cyber Security Centre, the Australian Cyber Security Centre, the Netherlands' National Cyber Security Centre, New Zealand's National Cyber Security Centre and the Canadian Centre for Cyber Security. The agency said it had not observed a successful attack. The Canadian Centre for Cyber Security reports that test attack code is publicly available, which can change that quickly. On the same day the PHP project published a note about a third, separate flaw (CVE-2026-115560). It affects only sites with an unusual configuration, the project describes it as unlikely, and the fix will come in its next regular release; until then it suggests turning off the “session upload progress” setting, which your host can do.
Updated 24 October 2026. This story is developing quickly. The facts below were checked on 24 October 2026; for the latest, see the PHP project's advisory and your hosting company.
If you cannot yet tell whether your website is at risk
Most people cannot yet measure their own PHP exposure this week, and that is an ordinary place to be, because it depends on which version a host runs and when it was last updated. Waiting for that answer is easier with protection in place for the signs that usually follow a flaw like this one: fake pages on hijacked websites, fake update notices, commands a page tells you to paste, and messages that imitate a site you trust. UtilForge.org has free checks for exactly those, and they run on your own phone or computer, so what you paste stays on your device:
- Before you paste a command: for any page that tells you to paste something to "verify you are human" or to "fix" a problem.
- Is this a scam text?: for a message that says your website or account needs urgent attention.
- Before you pay: for a payment page or a request for money that arrives after a site goes quiet.
- Hide names from AI: for anything you plan to paste into an artificial intelligence assistant while you ask for help with this.
All of the free checks are listed at https://utilforge.org/tools, and the free book How to Become Safer Online at https://utilforge.org/book covers the same warning signs in large print.
What happened
On 21 October 2026 the PHP project published a security advisory for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which security researchers nicknamed PHP2Shell. Both are rated 9.2 out of 10 for severity on the Common Vulnerability Scoring System, version 4.0. The advisory says they can allow unauthenticated remote code execution, which means a stranger who has no account on a website can make the server run commands of the stranger's choosing. It says every PHP installation that serves web requests is at risk, and that the risk is highest for the Apache web server using mod_php, a common setup. The PHP project adds that "updating is the only safe choice."
PHP is used by about 69.3 per cent of the websites whose server-side language is known, according to the technology survey site W3Techs on 22 October 2026. Wiz, the cloud security company whose researchers found the flaws, reports that every PHP version released in the last decade is affected by at least one of them, and that it demonstrated the attack against the WordPress, Drupal and Joomla website platforms. Nothing in the website's own code has to be faulty, because the flaws sit in the core of PHP.
How it came to light
The security firm Calif, working with OpenAI, reported the first flaw to the PHP project on 11 August 2026, and Wiz reported the second on 24 August, according to Reuters and Al Jazeera. Both firms credited artificial intelligence models in the discovery. Details leaked online on 20 October, a day before the planned release, and PHP brought its release forward to 21 October.
OpenAI describes the weeks between discovery and release as a "Defender's Window", a period in which people who protect websites can prepare fixes before attackers know where to look. Anthropic's Frontier Red Team reported on 29 September 2026 that the United States government's National Institute of Standards and Technology assessed one freely downloadable Chinese model, GLM-5.3, as about four months behind the leading United States models on cyber tasks. A window that lasted about two months this time may be shorter next time, which is a reason for everyone who runs a website to make updating a routine.
Is anyone attacking websites with it?
Yes. Amazon's security team wrote on 21 October 2026 that "PHP2Shell is now being broadly exploited in the wild", and that its sensors recorded the first attempt on 17 October, four days before the public release. In the same post Amazon says it is unclear whether any of those attempts would have succeeded against real systems. Reuters reported that Cloudflare's chief technology officer said early attacks were emerging, and Sky News reported that Cloudflare's chief executive, Matthew Prince, described attempts rising from thousands to millions within hours of the announcement. SecurityWeek reported that watchTowr saw attempts but no successes and that Hadrian described attacks at scale.
An attempt is a probe, and a probe does not mean a site was taken over. The sources read for this article, last checked on 22 October 2026, report attempts and a wide rush to patch, and none of them confirms a successful attack on a named website. The Cybersecurity and Infrastructure Security Agency said when it published its alert that it had not observed exploitation. Because the attempts began before the fixes existed, a site that has been updated may still need checking for signs that someone got in first.
Why websites went offline
On 21 October 2026 the National Security Agency of the United States issued a rare public warning that organisations unable to update straight away should consider taking their websites offline, according to Al Jazeera. Government websites then went offline as a precaution in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic. In the United Kingdom the Office for Budget Responsibility, Oxfordshire County Council and Hillingdon Council took their sites down while they investigated, Sky News reported, and the Wikimedia Foundation said it was addressing the flaws. These were precautions, and the reports describe them as that, not as proof that the sites had been hacked.
If you run a website
First find out who looks after PHP for your site: you, your hosting company, or a platform that handles it for you. If you manage the server yourself, install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever matches your current line, from php.net. Put the sites that anyone on the internet can reach first.
If a host manages the server, ask the host in writing which PHP version your site now runs and when it was updated. Some Linux distributions and long-term-support vendors received fixes before the public release and may show an older-looking version number, so ask before assuming the answer. In WordPress the version appears under Tools, then Site Health, then Info.
PHP 8.1 and older no longer receive updates from the PHP project. The project published source-code backports for 7.4, 8.0 and 8.1, and some vendors provide their own fixes, so ask your vendor, or move to a supported release. The United Kingdom's National Cyber Security Centre advises considering taking a system offline if it cannot be fixed or protected straight away, and checking for signs of compromise on systems that could not be updated, because a patch does not remove access an attacker may already have. PHP's advisory lists temporary measures and says that they "do not make an installation safe."
Check the update for anything that bundles PHP: control panels, appliances and software that came with your hosting. Reuters reported that the security company Wordfence warned that WordPress's usual automatic updates will not apply this fix, because the flaw is in PHP on the server and not in WordPress itself, so ask your host to update PHP.
Amazon's guidance, if you cannot update straight away, is to consider blocking file uploads to the site, after checking what that would break, and to review your server logs for unusual activity.
If you visit websites
PHP runs on the server, so there is nothing to install on a phone or laptop. The risk to visitors is indirect. Shahak Shalev of the security company Malwarebytes called the flaws a "goldmine for hackers" because attackers could take over real sites to phish people or serve malware, according to SecurityWeek. A site may also go offline for a while as its owner updates it, as the government websites above did, and a maintenance page does not mean the site was hacked. Wait for it to return before you log in again.
A hijacked site looks like the site you know. Rapid7 reported in March 2026 that more than 250 legitimate WordPress websites in at least 12 countries had been used to show fake "verify you are human" pages that told visitors to open the Windows Run box and paste in a command. So if a familiar site suddenly asks you to log in again, pushes a download, or tells you to paste a command, close the page. UtilForge's free "Before you paste a command" check looks at the text of a command and points out the signs of a fake fix, and it runs on your own phone or computer: https://utilforge.org/tools/before-you-paste-a-command
Use a different password for each site, turn on two-step login where it is offered, and turn on automatic updates on your own devices. The National Cybersecurity Alliance's Week 3 message for Cybersecurity Awareness Month says that criminals study each published update to learn which weakness it fixes and then look for people who have not installed it, so an update that has been waiting on a screen is a door left open.
Watch: the short video
Where UtilForge fits
UtilForge.org is a digital inclusion organisation offering free cybersecurity and online safety tools and guides, and a registered 2026 Champion of Cybersecurity Awareness Month. Its free checks cover the part of this problem that reaches ordinary people: fake pages, fake updates, messages that imitate a trusted site, and what to keep out of an artificial intelligence assistant. They are listed at https://utilforge.org/tools
Finding PHP on a server and installing the update remains the work of the person who runs that server, which is why the steps above begin with asking your host. UtilForge has no tool that finds PHP on a server, and this article does not claim one.
If your website runs PHP, who updates it for you, and when did they last tell you?
Sources checked on 22 October 2026: PHP project advisory (php.net, 21 October 2026); Amazon Security Blog (21 October 2026); Reuters (21 October 2026); Al Jazeera (22 October 2026); Sky News (21 to 22 October 2026, text read through syndicated copies); Wiz Research; CyberScoop; CSO Online; SecurityWeek; Huntress; the National Cyber Security Centre; the Cybersecurity and Infrastructure Security Agency; W3Techs; Rapid7 via Infosecurity Magazine; the National Cybersecurity Alliance. The Cloudflare figures come from Sky News reporting of a post on X and were not seen at source. This article is not legal or professional security advice.
Related guides
Free
If you doubt it,
UtilForge it.
Free checks that run on your own phone or computer. What you type stays on your phone or computer.