PHP2Shell: The Vulnerability That Forced Websites Around the World Offline

Last week, banks, hospitals, retailers and government agencies did something you never want to see a business do: they took their own websites offline on purpose. Not because they had been hacked. Because they couldn't prove they hadn't been.

The cause was two critical vulnerabilities in PHP, the programming language that quietly powers about 70% of the web (The Guardian). Researchers gave the pair a name, PHP2Shell, and a severity score of 9.2 out of 10 (BBC). Governments issued emergency guidance, and Cloudflare counted exploitation attempts moving from thousands to millions within days (The Guardian).

If your website runs on PHP (and if it was built on WordPress, Drupal, Joomla, or almost any generic website builder, it does), this was not just a news story. It was about you.

"The scariest part of PHP2Shell isn't the exploit. It's that a flaw that had been lurking in PHP's code for years suddenly became a master key to millions of servers, and the people using those servers couldn't do a thing about it."

What Is PHP, and Why Should You Care?

PHP is a server-side programming language: it runs on the machine hosting your website, generating the pages visitors see. It is free, it is easy to build with, and it has been around since the mid-1990s. Those qualities made it the default choice for the web's most popular platforms: WordPress, Drupal, Joomla, and MediaWiki (the software behind Wikipedia) all run on it. According to the cybersecurity firm Wiz, PHP powers 70% of the world's websites (BBC).

Here is the part that matters for you: if your business site was built on WordPress or a PHP-based platform, it runs PHP too, whether you have ever heard of the language or not. You never see it, but an attacker does not need you to see it.

What Actually Happened

Security researchers at the cybersecurity company Calif first found the two bugs in PHP's code back in 2024. At the time, they were written off as unexploitable, and they were never patched (TechCrunch). That changed recently: as part of the Hack the Planet initiative run by OpenAI and the cloud security firm Wiz, researchers found a chain of steps that turns the dormant flaws into a working attack, one Wiz described as sitting at the edge of what human researchers could practically achieve (TechCrunch).

The vulnerabilities are officially tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 in severity (BBC). The PHP Foundation released fixes on Wednesday, October 21, and CISA, the US cybersecurity agency, urged organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, later adding both flaws to its catalog of actively exploited vulnerabilities (CISA).

Why This Bug Is Different

Plenty of vulnerabilities require luck or effort from the victim. The target has to click a link, open a file, or leave a door half-open. PHP2Shell needs none of that.

It is unauthenticated remote code execution: anyone on the internet who knows the exploit can break into a vulnerable, unpatched PHP server without a password and without the owner doing anything wrong. The US National Security Agency warned the flaw could let attackers seize control of web servers, steal sensitive data, disrupt services, and move deeper into the network (The Guardian). It affects every kind of PHP setup that serves web requests, including Apache with mod_php (which PHP itself flags as the highest risk), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed (CISA).

The 48 Hours the Internet Held Its Breath

The timeline is worth reading slowly, because it shows how little warning a business gets when shared infrastructure breaks:

• October 17. Amazon Threat Intelligence says it detected exploitation of PHP2Shell days before any patch existed, suggesting someone, somewhere, knew how to abuse the bugs early (TechCrunch).
• The 10 hours before the announcement. Cloudflare recorded thousands of exploitation attempts before the public even knew the bug existed (The Guardian).
• October 21. The PHP Foundation releases patches, and CISA issues an alert urging immediate updates (CISA).
• The 45 minutes after. Tens of thousands of exploitation attempts hit Cloudflare's network. Within two hours: hundreds of thousands. Within days: millions, according to Cloudflare's chief executive (The Guardian).
• The same day. The UK pulled 32 government services offline as a precaution, and its cyber agency, the NCSC, sent 50,000 alerts to affected organisations. Wikimedia, the organization behind Wikipedia, took several of its systems down as a precaution, and banks, retailers, gaming sites and hospitals did the same to patch their servers (BBC).

So far, no successful attacks have been reported (BBC). But "no reports yet" is not the same as "nothing happened", and cyber-security researcher Salil Kanhere of UNSW Sydney expects exploitation attempts to keep climbing in the coming weeks now that the technical details are public (BBC).

How This Can Hit Your Website

If your site runs on PHP and your host has not patched, here is what an attacker can do with this bug, without ever needing your password:

• Take over your server. The NSA warned the flaw can give attackers control of web servers, and a "direct path" into the system's database (BBC).
• Steal your customers' data. Names, emails, order details, anything the site touches.
• Infect your visitors. Turn your website into a malware delivery system, quietly attacking everyone who trusts you enough to visit.
• Mine cryptocurrency on your dime. Crypto miners love hijacked servers: your hosting bill, their profits.
• Attack from your address. Hackers can use your server's IP to launch attacks that cannot be traced back to them. Your business becomes someone else's disguise (The Guardian).
• Lose the trust you built. A visitor cannot tell a hacked site from a safe one, and most do not come back to find out.

And here is the part nobody tells you: many compromised sites never know it happened. The UK's NCSC flagged that the patch does not even work on some older systems, which have to be replaced entirely, and that schools, local governments and charities often lack the technical help to respond at all (The Guardian). Small businesses are in exactly the same boat.

The Uncomfortable Lesson

Step back from the CVE numbers, because the real lesson is bigger than one bug.

One flaw, in one language, exposed millions of websites simultaneously. Not because those millions of businesses did anything wrong, but because they all built on the same aging foundation. When the technology under your website is shared by 70% of the internet, you inherit the risk of all of it: every bug, every delayed patch, every plugin nobody audits.

Why This Doesn't Apply to RQ-Scale Sites

We don't use PHP. Not an old version of it, not a patched version of it, none of it.

Our sites are custom-built React applications with static site generation: the pages are pre-built and served as optimized static files. There is no PHP interpreter on the server for PHP2Shell to exploit, no PHP runtime to patch in an emergency, and no plugin ecosystem of thousands of third-party components hoping someone, somewhere, keeps them safe.

To be clear: no technology is magic, and security is always a process, not a checkbox. But there is a simple, structural difference here, and this week proved it. A flaw that requires PHP to exist cannot touch a website that doesn't run PHP. While the rest of the web scrambled, there was nothing for us or our clients to patch.

If Your Website Runs on PHP, Do This Today

This is CISA's public guidance, not our invention, and it applies to every PHP site on the internet:

• Confirm your PHP version and update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (CISA).
• Ask your host directly whether they patched. Get an answer, not an assumption.
• Update WordPress core and every plugin. Outdated plugins are a second front door.
• If your system is too old to take the patch, treat that as the verdict it is: CISA's advice for organizations that cannot update is to take the system offline until it can be replaced (CISA).

Where This Leaves You

Whatever your website is built on, this week was a reminder worth keeping: a website runs on technology, and technology has bad weeks. The questions every business owner should be able to answer are simple ones. What is my site built on? Who patches it when a vulnerability like this lands? And how would I even know?

If you can answer all three comfortably, this article did its job. If not, that is worth fixing before the next PHP2Shell, not after.

And if you would ever like a website built so those questions have easy answers, that is exactly what we do at RQ-Scale: enterprise-grade React sites, coded from scratch for local businesses.

You can find us at rqscale.com/build.