# Critical PHP vulnerability puts 70% of websites at risk as governments urge immediate updates *Published:* 2026-10-21 *Author:* Farzan Hussain ![](https://bestforandroid.com/wp-content/uploads/2026/10/PHP-Cybersecurity-Warning-Alert_featured.jpg) A single flaw in the code behind 70% of the internet just sent governments and law enforcement agencies into emergency mode. Hackers were reportedly testing it before most sites had a chance to fix it. The [PHP Foundation](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security) released emergency updates on Wednesday to fix two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. The bugs sit in PHP, the programming language behind roughly 70% of websites globally, and could let attackers take control of a server without logging in. Security researchers found the flaws with the help of AI tools before patches were released. These two PHP2Shell vulnerabilities are memory-handling flaws. A hacker can send a special web request that confuses PHP’s internal cleanup process. This lets them run their own code on the server without any login or password. Once inside, they can read files, steal data from the database, or take full control of the site. PHP powers most of the web, so the risk is widespread. Update ASAP or take systems offline. What PHP is and why so many websites depend on it ------------------------------------------------- PHP is a scripting language that runs quietly on web servers and builds the pages you see. It powers WordPress, Drupal, Joomla, Magento, and the MediaWiki software behind Wikipedia. [Cloudflare](https://blog.cloudflare.com/php-vulnerabilities-waf-protection) says almost 70% of websites use it. The flaws are in PHP itself, so a site owner cannot fix them by updating a plugin or a theme. Both bugs score 9.2 out of 10 for severity. Only PHP 8.2 and newer get official patches, though the PHP team also released limited fixes for 7.4, 8.0, and 8.1 for people who build from source. Which sites went offline and what governments advised ----------------------------------------------------- Several sites switched themselves off on purpose rather than risk being hacked. Parts of Wikipedia, Pinboard, 4chan, and Something Awful went down, along with Finnish and French government sites and the Port of Rotterdam’s website. > Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or… > > — NSA Cyber (@NSACyber) [October 21, 2026](https://x.com/NSACyber/status/2112903220209098897?ref_src=twsrc%5Etfw) The US [National Security Agency](https://x.com/NSACyber/status/2112903220209098897), the UK’s National Cyber Security Centre, and the EU’s CERT-EU all said organizations that could not update right away should consider taking systems offline. The US cybersecurity agency CISA urged patching but said it had not seen exploitation at the time of its advisory. Cloudflare and Patchstack both reported attack attempts, and Cloudflare said attackers were already changing their tactics to get around its protections. How AI helped find the flaw and how a leak made things harder ------------------------------------------------------------- Security firms Calif and [Wiz](https://www.wiz.io/blog/php2shell-php-rce), along with [OpenAI](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/), found the bugs and reported them. Wiz said AI models let its team build working exploits in hours, something that used to take far more time and expertise. OpenAI warned that the same tools can help attackers just as quickly, and I find that part hard to ignore. The PHP Foundation also admitted that a researcher spotted early signs of one flaw back in 2024. It called the delay a structural failure. Then the disclosure plan fell apart: the CVE numbers leaked a day early, Calif accidentally posted a video of its proof of concept, and Chainguard allegedly published a fixed version more than six hours before the official release. What website owners and everyday users should do now ---------------------------------------------------- Site owners should [update to PHP 8.5.12](https://www.php.net/archive/2026.php#2026-10-21-5), 8.4.27, 8.3.36, or 8.2.35, or ask their hosting provider to do it. [Cloudflare turned on WAF protective rules](https://x.com/dok2001/status/2112811965735202970) for all customers, including free ones, but it calls them a stopgap. The FBI asked anyone who finds signs of a break-in to isolate the system, keep the logs, and report it. > PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. > > We are seeing early attacks emerging and are updating mitigations as new vectors show… > > — Dane Knecht 🦭 (@dok2001) [October 21, 2026](https://x.com/dok2001/status/2112811965735202970?ref_src=twsrc%5Etfw) If you only visit websites and do not manage any website, you cannot patch anything. What you can do is watch for breach notices from sites you use, switch on two-factor login, and avoid reusing passwords. Thankfully, the fix has been released, but the sites that worry me most are the forgotten ones that nobody will ever update.