What happened with the PHP bug in October 2026?

On Wednesday 21 October 2026, a pair of bugs in a piece of software most people have never heard of put a huge part of the internet at risk in a single afternoon. Councils, police forces and government departments across the UK and Europe switched their websites off as a precaution. If your business runs a WordPress website, this one affected you too, whether you noticed or not.

What is PHP?

Think of a website like a restaurant. The part you see (the menu, the décor, the tables) is front of house. PHP is the kitchen. It takes your order, such as a click, a search or a form you fill in, cooks up the right page and sends it back to your screen.

PHP has been around since the mid-1990s. It is free, open source and easy to work with, which is why it now sits underneath WordPress, WooCommerce shops, Drupal, Joomla, Wikipedia and countless intranets, booking forms and portals. It even runs inside the admin screens of some routers and firewalls.

You never see PHP. Your web host installs it on the server and it quietly gets on with the job. That is exactly why a flaw in PHP itself is so serious. It sits underneath everything else.

What was the PHP2Shell vulnerability?

PHP2Shell was the nickname for two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 for severity. According to the US Cybersecurity and Infrastructure Security Agency (CISA), they allowed unauthenticated remote code execution on any PHP installation serving web requests.

In plain English, an attacker anywhere in the world could send a specially crafted request to a website and take control of the server behind it. No password, no login, and nobody needed to click a dodgy link. Back in our restaurant, it is like someone shouting a particular phrase through the front door and being handed the keys to the kitchen.

Once inside, a criminal could steal customer data, plant malware, deface the site or leave a hidden back door to return through later.

Why was it so hard to defend against?

• It affected almost every setup. Apache, PHP-FPM, LiteSpeed and FrankenPHP, the common ways hosts run PHP, were all in scope.
• Security plugins could not stop it. The attack happens while PHP is still reading the request, before WordPress or any firewall plugin has loaded.
• Updating WordPress made no difference. The fix had to be made on the server, at the PHP level.

How did the PHP2Shell events unfold?

The fix was meant to be a carefully coordinated, quiet operation. Security researchers reported the flaws to the PHP project over the summer, and fixes were prepared under a strict embargo so the largest web hosts could patch first. It did not quite go to plan.

• 17 October: Amazon spotted attackers trying to exploit the flaw on its decoy servers, four days before anything was public.
• 20 October: PHP announced an emergency security release was coming. Details of the flaws leaked hours earlier.
• 21 October, around 3pm UK time: PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Websites began going dark across the UK and Europe.
• 22 October: The UK government confirmed 32 of its services were offline and four more partially disrupted, as The Times reported.
• 23 October: PHP disclosed a third, related flaw affecting unusually configured sites, and CERT-EU warned that working attack code was circulating.
• 26 October: CISA added PHP2Shell to its catalogue of vulnerabilities confirmed as actively exploited.

How bad was the PHP2Shell vulnerability?

Bad enough that the UK’s National Cyber Security Centre gave organisations a blunt choice: patch now, or take affected systems offline. Many chose to switch off first. In the UK, council websites in Edinburgh, Oxford, Bristol, Lambeth and Barnet were reported down or showing errors, along with the Metropolitan Police site and the Office for Budget Responsibility, days before the Budget.

Government sites in Germany, France, Belgium, Finland and the Netherlands were pulled too. Banks, retailers, hospitals and online shops took servers down to patch.

The good news is that weeks of behind-the-scenes coordination meant the internet broadly avoided a mass break-in. The UK government said it knew of no confirmed compromise of public sector systems. The bad news is that it is not over. Sites on PHP 8.1 or older get no official fix at all, and smaller businesses on cheaper hosting, with nobody checking the server, are exactly where attackers will look next.

Is my WordPress website at risk from PHP2Shell?

If your website runs on WordPress, it runs on PHP, so it was in the firing line. Who fixes it depends on how you are hosted. Large managed WordPress hosts generally patched for you. On shared hosting, your host updates PHP but you may need to switch to a newer version in your control panel. On your own server or VPS, nobody is patching it for you.

What should I check today?

• In WordPress, go to Tools, then Site Health, then Info, then Server, and note your PHP version. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
• If you are on PHP 8.1 or older, you have no official fix and need an upgrade plan.
• Avoid any plugin claiming to be a “PHP2Shell fix”. No WordPress plugin can patch PHP itself.
• Check staging sites, subdomains and old microsites too. Forgotten sites are the easiest targets.

If you have concerns about your WordPress website, please click here to contact us. We will check your PHP version, confirm whether you are exposed and get you upgraded safely.

What else happened in cyber security that week?

An SSL company whose secret key was the number 4

Indian certificate authority eMudhra, one of the companies trusted to issue the padlock certificates websites rely on, was found to have eight certificates protected by keys so weak they could be cracked in under a second. One was literally the number 4. Browsers blocked them within days and eMudhra announced it was leaving the global SSL business. Read the full story in our follow-up post.

GoDaddy revokes over 400,000 SSL certificates

In the same week, GoDaddy cancelled 404,607 SSL certificates after finding they had been issued in a way that did not match its own published rules. No hack was involved, but affected customers had to install replacements quickly or face browser security warnings.

Hobbs, Whistles and Phase Eight hit by a cyber attack

The owner of the three fashion brands identified a cyber attack on 11 October affecting its IT systems and some website features. ITV News reported that payment details were not believed to be at risk and the incident had been reported to the ICO. It came a week after Asos disclosed a data breach, a clear sign that retailers are in attackers’ sights ahead of Black Friday.

PHP2Shell was a reminder that the software holding your website together needs as much attention as the website itself. Patching the server, not just the plugins, is now part of basic hygiene, and our managed cyber security service keeps that under control so you do not have to wait for the next headline to find out you were exposed.