PHP, the programming language behind most of the web, released emergency security updates on 21 October 2026 for two critical flaws, and government websites across Europe and the United Kingdom went offline while their owners installed them. Amazon says the flaws are now being broadly exploited in the wild. Website owners need to update or ask their host to. Visitors can protect themselves with a few habits, and UtilForge has a free check for one of the tricks criminals use on hijacked websites.
By Lindsay McDonald, UtilForge spokesperson
Update, 6 November 2026. On 3 November 2026 the Cybersecurity and Infrastructure Security Agency added a flaw in WordPress (CVE-2026-119977) to its list of flaws used in real attacks. WordPress is the software that runs a large share of the world’s websites, and it is written in PHP. This flaw is separate from the PHP flaws: an attacker can use it without logging in, but only in the short window while a site is installing a full WordPress update, and it can let them run their own code on the server. WordPress has released fixed versions for every supported line, such as 7.1.4, 7.0.8 and 6.9.11. If you run a WordPress site, or pay someone to run it, ask for the latest WordPress security update to be installed, alongside the PHP fixes.
Update, 30 October 2026. On 28 October 2026 the Cybersecurity and Infrastructure Security Agency added a flaw in the core of the Linux operating system (CVE-2026-46300) to its list of flaws used in real attacks. On its own it needs an attacker who already has a foothold on the server. The agency says it can be combined with the two PHP flaws: the PHP flaws let an attacker place a hidden control page on a website, and the Linux flaw can then give that page full control of the machine. Fixed Linux kernel versions are 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and your hosting company or Linux supplier will name the update for your system. A patch does not remove access an attacker already has, so ask your host whether the server was checked for signs of entry. The security company Tenable reported on 29 October that working attacks on the PHP flaws have to be adjusted for each website’s setup, which it called hard but not impossible, and that none of the five test sites it exposed had been taken over. This update was checked in news reports of the agency’s listing, because the agency’s own pages could not be opened when it was written, so confirm it on the agency’s site (28 October alert). The steps for website owners are the same: update PHP and the server’s operating system, or ask your host to. UtilForge’s Question for Your Host writes that message for you.
Update, 29 October 2026. On 27 October 2026 the Cybersecurity and Infrastructure Security Agency added two more flaws to its list of flaws used in real attacks. One is in Brotli, a compression tool made by Google (CVE-2026-111497). On 26 October the PHP project released updated Windows builds, PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which include the fixed Brotli; the PHP version itself is unchanged, and on Windows the flaw can be reached through PHP’s cURL extension when automatic decompression is switched on. The other is in Adobe Commerce and Magento, software used to run online shops (CVE-2026-48356), so shop owners should apply Adobe’s security update. On 23 October the PHP project also published an informational advisory about a third issue (CVE-2026-115560) that affects only sites configured in an unusual way; its advice is to set session.upload_progress.enabled=0 until the next regular release, which sites that followed the earlier advice have already done. No attacks on this third issue have been reported.
Update, 27 October 2026. The Cybersecurity and Infrastructure Security Agency’s 26 October catalogue update lists both PHP flaws (CVE-2026-109618 and CVE-2026-109619) in its Known Exploited Vulnerabilities catalogue, the agency’s list of flaws used in real attacks. This changes the earlier position that the agency had not observed a successful attack. The listing was checked in a public copy of the catalogue, because the agency’s own pages could not be opened when this update was written, so confirm it on the agency’s site. The steps are the same: update PHP, or ask your host to. On 26 October the PHP project also released rebuilt Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1) that include a fix for a separate flaw in a compression library called Brotli (CVE-2026-111497). It can be reached only when a site’s web-request software has automatic decompression turned on, which is off by default. Windows servers should install the rebuilt packages.
Update, 24 October 2026. On 23 October 2026 the Cybersecurity and Infrastructure Security Agency updated its alert. It names the fixed releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says organisations still running PHP 8.1 or older, or unable to update straight away, should take those systems offline until they are updated. It adds a detection rule for security teams and points to matching alerts from the National Security Agency, the United Kingdom's National Cyber Security Centre, the Australian Cyber Security Centre, the Netherlands' National Cyber Security Centre, New Zealand's National Cyber Security Centre and the Canadian Centre for Cyber Security. The agency said it had not observed a successful attack. The Canadian Centre for Cyber Security reports that test attack code is publicly available, which can change that quickly. On the same day the PHP project published a note about a third, separate flaw (CVE-2026-115560). It affects only sites with an unusual configuration, the project describes it as unlikely, and the fix will come in its next regular release; until then it suggests turning off the “session upload progress” setting, which your host can do.
Updated 6 November 2026. This story is developing quickly. The facts below are current to the 27 October update above; for the latest, see the PHP project's advisory and your hosting company.
If you cannot yet tell whether your website is at risk
Most people cannot yet measure their own PHP exposure this week, and that is an ordinary place to be, because it depends on which version a host runs and when it was last updated. Waiting for that answer is easier with protection in place for the signs that usually follow a flaw like this one: fake pages on hijacked websites, fake update notices, commands a page tells you to paste, and messages that imitate a site you trust. UtilForge.org has free checks for exactly those, and they run on your own phone or computer, so what you paste stays on your device:
- Before you paste a command: for any page that tells you to paste something to "verify you are human" or to "fix" a problem.
- Is this a scam text?: for a message that says your website or account needs urgent attention.
- Before you pay: for a payment page or a request for money that arrives after a site goes quiet.
- Hide names from AI: for anything you plan to paste into an artificial intelligence assistant while you ask for help with this.
All of the free checks are listed at https://utilforge.org/tools, and the free book How to Become Safer Online at https://utilforge.org/book covers the same warning signs in large print.
What happened
On 21 October 2026 the PHP project published a security advisory for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which security researchers nicknamed PHP2Shell. Both are rated 9.2 out of 10 for severity on the Common Vulnerability Scoring System, version 4.0. The advisory says they can allow unauthenticated remote code execution, which means a stranger who has no account on a website can make the server run commands of the stranger's choosing. It says every PHP installation that serves web requests is at risk, and that the risk is highest for the Apache web server using mod_php, a common setup. The PHP project adds that "updating is the only safe choice."
PHP is used by about 69.3 per cent of the websites whose server-side language is known, according to the technology survey site W3Techs on 22 October 2026. Wiz, the cloud security company whose researchers found the flaws, reports that every PHP version released in the last decade is affected by at least one of them, and that it demonstrated the attack against the WordPress, Drupal and Joomla website platforms. Nothing in the website's own code has to be faulty, because the flaws sit in the core of PHP.
How it came to light
The security firm Calif, working with OpenAI, reported the first flaw to the PHP project on 11 August 2026, and Wiz reported the second on 24 August, according to Reuters and Al Jazeera. Both firms credited artificial intelligence models in the discovery. Details leaked online on 20 October, a day before the planned release, and PHP brought its release forward to 21 October.
OpenAI describes the weeks between discovery and release as a "Defender's Window", a period in which people who protect websites can prepare fixes before attackers know where to look. Anthropic's Frontier Red Team reported on 29 September 2026 that the United States government's National Institute of Standards and Technology assessed one freely downloadable Chinese model, GLM-5.3, as about four months behind the leading United States models on cyber tasks. A window that lasted about two months this time may be shorter next time, which is a reason for everyone who runs a website to make updating a routine.
Is anyone attacking websites with it?
Yes. Amazon's security team wrote on 21 October 2026 that "PHP2Shell is now being broadly exploited in the wild", and that its sensors recorded the first attempt on 17 October, four days before the public release. In the same post Amazon says it is unclear whether any of those attempts would have succeeded against real systems. Reuters reported that Cloudflare's chief technology officer said early attacks were emerging, and Sky News reported that Cloudflare's chief executive, Matthew Prince, described attempts rising from thousands to millions within hours of the announcement. SecurityWeek reported that watchTowr saw attempts but no successes and that Hadrian described attacks at scale.
An attempt is a probe, and a probe does not mean a site was taken over. The sources for this article report attempts and a wide rush to patch, and none of them confirms a successful attack on a named website. The Cybersecurity and Infrastructure Security Agency said when it published its alert that it had not observed exploitation. Because the attempts began before the fixes existed, a site that has been updated may still need checking for signs that someone got in first.
Why websites went offline
On 21 October 2026 the National Security Agency of the United States issued a rare public warning that organisations unable to update straight away should consider taking their websites offline, according to Al Jazeera. Government websites then went offline as a precaution in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic. In the United Kingdom the Office for Budget Responsibility, Oxfordshire County Council and Hillingdon Council took their sites down while they investigated, Sky News reported, and the Wikimedia Foundation said it was addressing the flaws. These were precautions, and the reports describe them as that, not as proof that the sites had been hacked.
If you run a website
First find out who looks after PHP for your site: you, your hosting company, or a platform that handles it for you. If you manage the server yourself, install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever matches your current line, from php.net. Put the sites that anyone on the internet can reach first.
If a host manages the server, ask the host in writing which PHP version your site now runs and when it was updated. Some Linux distributions and long-term-support vendors received fixes before the public release and may show an older-looking version number, so ask before assuming the answer. In WordPress the version appears under Tools, then Site Health, then Info.
PHP 8.1 and older no longer receive updates from the PHP project. The project published source-code backports for 7.4, 8.0 and 8.1, and some vendors provide their own fixes, so ask your vendor, or move to a supported release. The United Kingdom's National Cyber Security Centre advises considering taking a system offline if it cannot be fixed or protected straight away, and checking for signs of compromise on systems that could not be updated, because a patch does not remove access an attacker may already have. PHP's advisory lists temporary measures and says that they "do not make an installation safe."
Check the update for anything that bundles PHP: control panels, appliances and software that came with your hosting. Reuters reported that the security company Wordfence warned that WordPress's usual automatic updates will not apply this fix, because the flaw is in PHP on the server and not in WordPress itself, so ask your host to update PHP.
Amazon's guidance, if you cannot update straight away, is to consider blocking file uploads to the site, after checking what that would break, and to review your server logs for unusual activity.
If you visit websites
PHP runs on the server, so there is nothing to install on a phone or laptop. The risk to visitors is indirect. Shahak Shalev of the security company Malwarebytes called the flaws a "goldmine for hackers" because attackers could take over real sites to phish people or serve malware, according to SecurityWeek. A site may also go offline for a while as its owner updates it, as the government websites above did, and a maintenance page does not mean the site was hacked. Wait for it to return before you log in again.
A hijacked site looks like the site you know. Rapid7 reported in March 2026 that more than 250 legitimate WordPress websites in at least 12 countries had been used to show fake "verify you are human" pages that told visitors to open the Windows Run box and paste in a command. So if a familiar site suddenly asks you to log in again, pushes a download, or tells you to paste a command, close the page. UtilForge's free "Before you paste a command" check looks at the text of a command and points out the signs of a fake fix, and it runs on your own phone or computer: https://utilforge.org/tools/before-you-paste-a-command
Use a different password for each site, turn on two-step login where it is offered, and turn on automatic updates on your own devices. The National Cybersecurity Alliance's Week 3 message for Cybersecurity Awareness Month says that criminals study each published update to learn which weakness it fixes and then look for people who have not installed it, so an update that has been waiting on a screen is a door left open.
Watch: the short video
Where UtilForge fits
UtilForge.org puts cybersecurity first, with practical tools and guides for a safer online world for all, and a registered 2026 Champion of Cybersecurity Awareness Month. Its free checks cover the part of this problem that reaches ordinary people: fake pages, fake updates, messages that imitate a trusted site, and what to keep out of an artificial intelligence assistant. They are listed at https://utilforge.org/tools
Finding PHP on a server and installing the update remains the work of the person who runs that server, which is why the steps above begin with asking your host. UtilForge has no tool that finds PHP on a server, and this article does not claim one.
If your website runs PHP, who updates it for you, and when did they last tell you?
Sources: PHP project advisory (php.net, 21 October 2026); Amazon Security Blog (21 October 2026); Reuters (21 October 2026); Al Jazeera (22 October 2026); Sky News (21 to 22 October 2026, text read through syndicated copies); Wiz Research; CyberScoop; CSO Online; SecurityWeek; Huntress; the National Cyber Security Centre; the Cybersecurity and Infrastructure Security Agency; W3Techs; Rapid7 via Infosecurity Magazine; the National Cybersecurity Alliance. The Cloudflare figures come from Sky News reporting of a post on X and were not seen at source. This article is not legal or professional security advice.
Related guides
Free
If you doubt it,
UtilForge it.
Free checks that run on your own phone or computer. What you type stays on your phone or computer.