TL;DR: A PHP bug put around 70% of websites at risk in October 2026. PHP2Shell was two critical flaws in PHP, the engine behind WordPress and most of the web. Attackers could take over a web server without a password or any click from a user. UK government services, councils and the Met Police took websites offline while they patched. Updating WordPress does not fix it. The PHP version on your server must be updated. On Wednesday 21 October 2026, a pair of bugs in a piece of software most people have never heard of put a huge part of the internet at...