On 21 October 2026, websites across Europe, Japan and beyond started switching themselves off. Government portals, banks, airlines, hospitals, the BBC, Wikimedia and the Internet Archive all took some services offline. They weren't hacked. They were racing to fix a pair of critical flaws in PHP, the language behind most of the web, before attackers could use them. This guide explains what happened in plain words, how it could hit your website, what to do today, and which technologies make sense from here.
🚨What is PHP2Shell? What happened, hour by hour
Two vulnerabilities in PHP itself, now nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker run their own code on a web server without logging in. In some setups the attack works before your website's own code even starts, so a well-written site gives no protection on its own.
The flaw was found with help from an AI model at OpenAI, which called it "one of the most impactful vulnerabilities in recent memory". The good news: it was found before criminals found it, which gave defenders a short head start. The bad news: once the fix was public, attackers could study it too, and early attacks were reported soon after.
🌍Why this PHP vulnerability is so big
PHP isn't a niche tool. It runs WordPress, WooCommerce, Magento, Drupal, Joomla, Laravel apps, most shared hosting, and countless custom business portals. If your site was built in the last 15 years on a typical host, there's a good chance it runs on PHP, even if nobody told you.
Share of websites using PHP
Among websites whose server language is known. Source: W3Techs, 22 Oct 2026.
Which PHP versions sites run
At least 34.7% of PHP websites run PHP 7 or older, which get no official fix. Some PHP 8 sites (8.0 and 8.1) are also out of support. Source: W3Techs.
on versions with no official fix
released on 21 Oct
severity, for each flaw
🧨How the attack works, in plain words
Normally a visitor sends a request, PHP runs your website's code, and a page comes back. With PHP2Shell, a specially crafted request tricks PHP itself into running the attacker's commands. Watch the path below.
Two things make this dangerous: no password is needed, and a backdoor can stay after you patch. That's why security experts say that if you find signs of an attack, you should treat the server as compromised, not just "exposed".
🔌Which websites were taken offline
Most of these were precautions, not breaches. Organisations chose a few hours of downtime over the risk of a hidden attack. Hover a country to see who acted.
Sources: Global Banking & Finance Review factbox, The National, Malwarebytes. The list is not complete.
📉What the PHP security flaw could cost your website
Big organisations can afford a planned shutdown. A small business can't always, and an attack costs far more than a patch. Use the calculator to see what downtime alone costs you, before counting any data breach. Use your own figures.
Clean-up time is our estimate from typical incidents, before fines, data loss, legal costs and Google flagging the site as unsafe.
Get my site checked todayThe hidden damage, beyond downtime
Relative impact, our assessment for a typical small business website. Bars show severity, not probability.
🧪Is your website at risk? 60-second check
Tick everything that's true for your site. Your risk level updates as you go.
🔎How to check and update your PHP version
You don't need to be technical to find out where you stand. Pick the option that matches how your website is run.
- Log in to your dashboard
- Go to Tools › Site Health › Info
- Open Server and read the PHP version
- If it's below a fixed version, ask your host to update PHP, or switch it in your hosting panel
- Log in to your hosting control panel
- Open MultiPHP Manager (cPanel) or PHP Settings (Plesk)
- Choose PHP 8.3 or 8.4 for your domain and save
- Ask your host to confirm the latest security release is installed
- Run
php -vto see the version - Update with your system's package manager, for example
apt upgrade php* - Restart PHP-FPM and your web server
- Run
php -vagain to confirm
Before changing PHP versions, take a full backup and test on a staging copy if you can. Old themes and plugins sometimes break on newer PHP. If that sounds risky, our team can do the upgrade safely for you.
🛠️PHP security update: your action plan
- Confirm your PHP version with your host or developer
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer
- If you can't update now, put the site behind a web firewall or take it offline
- Remember: updating WordPress or plugins does not update PHP
- Scan for unknown files, new admin users and odd scheduled tasks
- Review server and access logs since 21 October
- Reset passwords, database keys and API keys
- Check Google Search Console for security warnings
- Find every PHP app you run, including old microsites and tools
- Set up automatic security updates and uptime monitoring
- Add daily off-site backups you've actually tested
- Decide whether to upgrade, re-platform or move to managed hosting
🧭Which technology should you choose now?
Here's the honest answer: PHP is not "dead". A patched, supported, well-hosted PHP site is perfectly safe for most businesses. The real risk is old, unmanaged software of any kind. Still, if your site is due a rebuild anyway, this is a good moment to choose deliberately. Pick an option to compare.
Scores are our team's guidance for a typical small or mid-sized business site, not benchmarks. The right choice depends on your features, budget and team.
🤝How the TECHTARN team can help, starting today
We've been patching, hardening and rebuilding business websites for years. Whatever state your site is in, we can take it from here.
- Find your PHP version and every PHP app
- Patch, or safely shield the site while we upgrade
- Quick check for signs of intrusion
- Written confirmation for your records
- Malware and backdoor scan
- Firewall, logins, file permissions and backups
- Uptime and security monitoring
- Ongoing updates with our maintenance plans
- Move to the latest PHP and framework versions
- Or rebuild on Next.js, Python or .NET
- Faster, safer hosting on managed cloud
- SEO kept intact during the move
❓Questions website owners are asking
My site went offline. Was it hacked?
Not necessarily. Many hosts and organisations took sites down on purpose to patch them. Ask your host what happened, then check for unknown files, new admin users and strange redirects.
I updated WordPress and all plugins. Am I safe?
Not from this. PHP2Shell is in PHP itself, which runs underneath WordPress. Your host or server admin has to update PHP. Check the PHP version under Tools › Site Health › Info › Server in WordPress.
How do I check my PHP version?
On WordPress, go to Tools › Site Health › Info › Server. On cPanel, open MultiPHP Manager. On your own server, run php -v. If you can't find it, your host or developer can tell you in minutes.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. PHP 8.1 and older no longer get routine security fixes from the PHP project, so you need a patch from your hosting or OS vendor, or an upgrade.
Is a firewall enough?
Only as a short-term shield. Web application firewall rules can block known attack patterns, but security teams describe them as a stopgap. The fix is updating PHP.
Should I move away from PHP?
Not just because of this. Every language has security issues; what matters is staying updated. If your site needs a rebuild anyway, Next.js, Python or .NET can be good fits. We'll recommend what suits your business, including staying on PHP.
How fast can TECHTARN help?
For the emergency fix, we aim to start within hours and finish within 24 hours for most sites. Message us on WhatsApp or use the form below.
Sources: Malwarebytes, The National, Global Banking & Finance Review, W3Techs. Facts as reported on 22 October 2026; the situation may change.