Two critical bugs in PHP, the programming language behind most of the web, let an attacker take over a web server without logging in. PHP shipped fixes on Wednesday, October 21. Installing them is the job of whoever runs the server, usually a web host. The people who visit a site have nothing to install.

That is why parts of the web went quiet this week. The flaws, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, sit in PHP itself rather than in any one website’s code. So a WordPress blog, an online store and a government portal can all be exposed at once if nobody has updated the server underneath.

Why some sites went dark on Wednesday

PHP is everywhere. According to W3Techs, 69.3% of websites whose server-side language the survey can identify run on it. That includes every site built on WordPress.

Varicose Veins and Blood Clots Will Disappear Very Quickly ! at Home!

varicose veins and blood clots will disappear very quickly ! at home!...

October 22, 2026

2:56 am

A young face overnight. You have to try this!

a young face overnight. you have to try this!...

October 22, 2026

3:25 am

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 22, 2026

3:17 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

October 22, 2026

3:00 am

Some sites broke or went offline on Wednesday. The Verge reported major issues at 4chan, DeviantArt and Wikipedia, and said some Dutch and Finnish government agencies took sites down as a precaution. The Record counted “hundreds” of sites offline and named Nintendo among companies that pulled services.

Governments encouraged that caution. The NSA’s advisory says that if “an immediate update is not feasible,” organizations should take the system offline until they can fix it. It also notes the bugs are “flaws in PHP itself, not in the hosted application or its configuration.” The UK’s National Cyber Security Centre gave the same advice.

The PHP security team rates both bugs 9.2 out of 10 on the CVSS v4 scale. Its security announcement says the two bugs “can allow unauthenticated remote code execution.” In plain terms, a stranger can make the server run their own commands without a password.

People From America Those With Knee And Hip Pain Should Read This!

people from america those with knee and hip pain should read this!...

October 22, 2026

3:13 am

Hair Will Grow Back! No Matter How Severe the Baldness

hair will grow back! no matter how severe the baldness...

October 22, 2026

3:15 am

Doctor: Іf You Have Nail Fungus, Do This Immediately

doctor: Іf you have nail fungus, do this immediately...

October 22, 2026

3:03 am

Lose 40 lbs by Consuming Before Bed for a Week

lose 40 lbs by consuming before bed for a week...

October 22, 2026

3:08 am

Attackers were probing servers before the fix shipped

The release came a day early. The PHP Foundation says it had planned to publish on October 22. Then the two CVE numbers began circulating online around 15:00 UTC on October 20, so the team moved the release to 14:00 UTC (10 a.m. ET) the next day.

Some attackers appear to have had a head start. Amazon’s security chief CJ Moses wrote that Amazon’s decoy servers caught a PHP2Shell attempt on October 17, four days before disclosure. In the same post, Amazon said the bug was “now being broadly exploited in the wild.” Cloudflare’s chief technology officer, Dane Knecht, said the company was “seeing early attacks emerging,” according to Tenable.

Not every company saw the same thing. The security firm Huntress said at 4:30 p.m. ET on Wednesday that it had not observed exploitation on its customers’ systems. That gap probably reflects who each company watches, not whether attacks are real.

Tired of debt? Become a money magnet and leave poverty behind!

tired of debt? become a money magnet and leave poverty behind!...

October 22, 2026

3:00 am

Varicose Veins Will Disappear in the Morning! Read!

varicose veins will disappear in the morning! read!...

October 22, 2026

2:56 am

This product is putting plastic surgeons out of work

this product is putting plastic surgeons out of work...

October 22, 2026

3:06 am

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 22, 2026

3:02 am

AI also played a part in the discovery. The security firms Calif and Wiz and the AI company OpenAI found the bugs.

In its Patch the Planet post, OpenAI says Calif found one flaw using OpenAI’s GPT-5.6 Sol model. It calls PHP2Shell “one of the most impactful security issues in recent memory.” Wiz says it used Google’s Gemini 4 Argon and GPT-5.6 Sol. It adds that every PHP version from the past decade has at least one of the bugs.

Calif’s own writeup says it confirmed attacks that need no login against specific versions of WordPress, Drupal, Joomla, Magento, MediaWiki and Nextcloud.

Read This Immediately if You Have Moles or Skin Tags, It's Genius

read this immediately if you have moles or skin tags, it's genius...

October 22, 2026

2:59 am

I did this and my knees and joints haven’t hurt for 10 years now.

i did this and my knees and joints haven’t hurt for 10 years now....

October 22, 2026

3:14 am

Hair Grows Back in 2 Weeks! at Any Stage of Baldness

hair grows back in 2 weeks! at any stage of baldness...

October 22, 2026

2:58 am

Do This Every Night and the Fungus Will Disappear in 5 Days

do this every night and the fungus will disappear in 5 days...

October 22, 2026

3:14 am

What PHP2Shell means for you as a visitor

You don’t need to update anything on your phone or laptop. PHP runs on the web server, not in your browser. Malwarebytes also points out that a maintenance page doesn’t mean hackers got in. More likely, someone is installing the patch.

The real risk sits on the server side. The NSA says a successful attacker could “steal sensitive data, disrupt services, or move deeper into a network.” For a visitor, that means the account details, order history or saved addresses a site keeps about you. An attacker could also plant malicious downloads or redirects on a site you trust.

Malwarebytes’ advice is to leave any familiar page that suddenly asks you to log in again, pushes a download or sends you somewhere unexpected.

My weight was 198 lbs, and now it’s 128 lbs! My diet is simple. 1/2 Cup Of This (Before Bed)

my weight was 198 lbs, and now it’s 128 lbs! my diet is simple. 1/2 cup of this (before bed)...

October 22, 2026

3:02 am

After Reading This, You Will Be Rich in 7 Days

after reading this, you will be rich in 7 days...

October 22, 2026

3:03 am

Varicose veins will go away ! The easiest way!

varicose veins will go away ! the easiest way!...

October 22, 2026

3:07 am

55-year-old woman with baby face. Here's her secret!

55-year-old woman with baby face. here's her secret!...

October 22, 2026

3:23 am

The usual habits do the most good. A different password for every site, plus two-factor login wherever a site offers it, means one breached store can’t unlock your email or bank. If a site you use later announces a breach, change that password first.

Your web host usually has to apply the fix

Who has to act depends on what your site runs on. The Verge says Squarespace and Wix sites are in the clear, because those platforms don’t support PHP.

Owners on shared or managed WordPress hosting rely on the host to update PHP on its servers. GoDaddy says any site using PHP should assume it is affected, according to The Verge. Anyone running their own server has to patch it themselves.

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 22, 2026

3:11 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

October 22, 2026

3:24 am

People From US Those With Knee And Hip Pain Should Read This!

people from us those with knee and hip pain should read this!...

October 22, 2026

3:15 am

Hair Grows Back in 2 Weeks! at Any Stage of Baldness

hair grows back in 2 weeks! at any stage of baldness...

October 22, 2026

3:06 am

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older sites have a harder road. PHP 8.1 and older no longer get official releases. The PHP team published do-it-yourself source patches for versions 7.4 through 8.1, and versions 5.4 through 7.3 get no fix at all.

That gap is large. W3Techs counts 26.9% of PHP sites on version 7 and 7.7% on version 5. Taken together, more than a third of PHP sites run version 7 or older, and none of those versions has an official fixed release. Some Linux vendors do backport fixes for older versions, so those owners should ask their vendor or host.

Check your site in three steps

Our own checklist, built from the PHP, NSA and Amazon guidance:

1. Find out who runs PHP for you. On Squarespace or Wix, you have nothing to do. On a hosting plan, the host updates PHP. On your own server, you do.
2. Look up your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Compare it with 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions often backport fixes without changing the number, so if yours looks lower, ask your host before you panic.
3. Get the fix confirmed in writing, and cover the gap. Ask your host to confirm the patched build is live. Until then, Cloudflare’s firewall rules block known attack patterns for sites behind it, even on free plans. Cloudflare says to keep them on while patching, not instead of it. If you can’t patch, follow the NSA and take the site offline. Amazon also advises checking your server logs back to October 17, not just from the disclosure date.

The pressure won’t ease soon. AI agents have already tried to break into a Canadian government website, and browser makers this week blocked eMudhra’s certificates over a separate security failure. OpenAI says PHP2Shell is one of several major bugs it is working to fix. It expects similar findings to “increase sharply in the coming months.”

Sites that patch this week aren’t finished, either. PHP says version 8.2 reaches end of life on December 31, 2026. Anyone on that branch has about ten weeks to move to 8.3 or newer.