The PHP Vulnerability That Knocked Websites Offline This Week: Is Yours Secure?

Picture this. You wake up, grab your coffee and check your phone. A customer has texted you a screenshot: your website is showing a stranger's message. Your contact form has been quietly sending people's names and phone numbers somewhere else. The passwords stored on your server are sitting in a hacker's pocket. And you didn't click anything. You didn't do anything wrong.

To be clear, that's what could have happened. These were potential consequences of the flaws, not confirmed outcomes at the organizations you'll read about below.

That was the worst case on the table this week. A PHP vulnerability was discovered that could let a stranger take over a website's server without ever logging in, and it sat underneath most of the internet.¹

Here's the good news: for most sites, the worst case didn't happen. Hosting companies raced to patch, and the fix came out Wednesday.^{1 2} But it was serious enough that governments, police departments, a major hospital and the nonprofit behind Wikipedia took websites and systems offline on purpose rather than risk it.^{3 4 5} Most of those were precautions, not hacks.

So let's talk about what happened, how a website actually works (no tech degree needed), and how to know whether your site is safe.

What happened with the PHP vulnerability?

Here's the story in order.

Tuesday, October 20. Details about two flaws in PHP leaked online before a fix was ready. Security researchers nicknamed them "PHP2Shell." The PHP team announced an emergency fix for the next day.¹

Wednesday morning, before the fix. Organizations had to make a hard call: stay online with a known hole, or switch off. Many switched off. In the Netherlands, the national login system DigiD, the House of Representatives and even the country's own cybersecurity center went dark.¹ In the UK, sites for Edinburgh and Oxford councils and the Metropolitan Police were reported unavailable.⁴ In Germany, the Charité hospital in Berlin took its whole website down.⁵ Government sites in Finland, France and Denmark were affected too.³

Wednesday, early morning (U.S. time). Cloudflare said it was already seeing attacks. Hosting partners reported active attacks to Patchstack around the same time.¹

Wednesday, just before 14:00 UTC (about 10 a.m. Eastern). PHP released the fix: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.¹

Here in the U.S., the NSA's Cybersecurity Division told organizations to be ready to update, and to take systems offline if they couldn't.³ As of Wednesday's reporting, there was no evidence U.S. federal websites had been hacked or taken offline because of it,³ and German tech outlet heise reported no confirmed successful break-ins so far.⁵ Attacks being attempted isn't the same as attacks working, and that difference matters.

So, close call. Now let's make sure you understand why it was a close call, because the same thing will happen again.

How a website actually works (the house version)

Think of your website like a house.

• The paint, furniture and pictures on the wall are your design. That's what visitors see.
• The address is your domain name (yourbusiness.com). It's how people find the house.
• The land the house sits on is your hosting. Somebody owns that land and you rent it.
• The foundation and the frame are the code that makes it all stand up. For roughly 7 out of 10 websites, that foundation is a language called PHP.⁶

Here's the whole cheat sheet in one place:

On a house	On a website	In plain English
Paint, furniture, pictures	Design	What visitors see and click
Street address	Domain (yourbusiness.com)	How people find you
The land	Hosting	The computer your site lives on, which you rent
Foundation and frame	PHP	The code language that makes many sites work behind the scenes
A ready-made house kit	WordPress	A popular website system built with PHP
Add-ons (alarm, hot tub, sprinklers)	Plugins	Extra features, each made by a different company
The maintenance crew	Your host or web person	Whoever keeps it all patched and running

PHP was created back in 1995, and WordPress was built on top of it in 2003. Both did a lot of good. They're a big reason small businesses can have websites at all. Today WordPress alone runs 39.6% of all websites.⁷

Here's what happened this week, in house terms: inspectors found a crack in the foundation that most of the houses on the street share. And it wasn't a crack you could see from the front yard.

That's the part most business owners don't realize. You can update WordPress and every plugin and theme you've got... and none of it fixed this. Updating WordPress is repainting the walls. This problem was in the concrete underneath.³ Only whoever controls the land (your host, or whoever manages your server) could pour the new foundation.

Did your website go down this week? Would you even know?

Ask yourself three honest questions:

1. Do you know what your website is built on? WordPress? Wix? Something your nephew set up?
2. Do you know who your host is, and whether they patched this on Wednesday?
3. If your site went down at 2 a.m., who would notice first? You, your web person, or a customer who gave up and called your competitor?

If you hesitated on any of those, you're not alone. Most of the owners I talk to know their website looks fine. Very few know what's holding it up.

And the "who's in charge of the foundation" answer really matters. On Wednesday, GoDaddy said its managed WordPress hosting was already patched, while its regular web hosting servers were still waiting on patched software from a vendor, with temporary protections in place.² Same company, two very different answers depending on which plan you're on.

Why older websites are the most exposed

Remember that crack in the foundation? Now imagine your house was built so long ago that the inspectors don't even make repair kits for it anymore.

That's what's happening with older PHP versions. PHP's official updates only cover its newer versions. For 8.1 and older, the PHP team published bare-bones patches for people who build PHP themselves, but most of those sites had to count on their host or another vendor to apply a fix.¹ By W3Techs' count, 34.7% of PHP websites still run version 7 or older, and another 21% of PHP 8 websites are on 8.0 or 8.1.^{6 8} That's a big share of the web running on versions PHP itself no longer updates.

This also isn't the first big scare this year. In July, a separate chain of flaws called "wp2shell" was found in WordPress itself, and Wiz Research later saw attackers using it to plant backdoors on sites.⁹

The DVD player vs. streaming

I explain it to clients like this. A WordPress website is a lot like owning a DVD player.

Remember DVDs? You bought the player, you bought the discs, and keeping it all working was on you. Scratched disc? Your problem. Player needs an update? Your problem. Want something new? Go buy another disc. It worked great for years. Most of us don't use one anymore.

Then streaming came along. You press play. The hard parts are handled by people whose whole job is handling them.

Websites are making the same move. A traditional WordPress site relies on PHP running behind the scenes to build pages and handle requests. Caching can speed that up, but the PHP engine is still there, and it still needs security updates. Add plugins (each one a little add-on written by a different company) and you've got a lot of doors to lock.

The newer, static-first way builds your pages ahead of time and delivers them from a global network. Visitors get a finished page, and there's no PHP engine processing their requests.

To be fair to WordPress: a well-run WordPress site on a good host can be very secure. Security comes down to how a site is built, set up and maintained, not just the brand name on it. The question is who's doing that work, and how many parts they have to watch.

You can stay on DVDs for a while. But the industry is moving to streaming, so you might as well get there on your schedule instead of during an emergency.

If you're on WordPress, here's what I would do this week

You don't have to rebuild anything today. Here's my checklist if I were in your shoes:

1. Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Write the number down.
2. Ask your host one direct question. "Has the October 21, 2026 PHP security fix for CVE-2026-109618 and CVE-2026-109619 been applied to my server?" Those two codes tell support exactly what you mean. Get the answer in writing.
3. If you're on PHP 8.1 or older, ask your host to move you to a supported version, or confirm they've applied a backported fix. Then plan an upgrade. Test it first, because old plugins can break on new PHP.
4. Don't install random "fix" plugins or paste code snippets you found online. Security firm Patchstack specifically warns against them.¹
5. If your host was slow to patch or suspects an attack, ask for an incident review. These flaws could expose what was in the server's memory, which can include passwords and keys.¹ Make sure the fix is applied first. Then change passwords and replace any API keys or other credentials the server held, and have someone check that no attacker left a way back in. A new password alone won't fix a break-in.
6. Set up a free uptime monitor so you hear about an outage before your customers do. Tools like UptimeRobot will email or text you.
7. Make sure you have a recent backup stored somewhere other than your web server.

If your site collects leads, payments or client information, treat steps 2 and 5 as urgent, not "someday."

Radical transparency: what we do differently

Here's the part where I tell you what we do. You knew it was coming, so I'll keep it short and honest.

Our High-Performance Websites don't use PHP to serve pages, so they weren't directly exposed to these particular PHP vulnerabilities. You're reading this on one right now. Here's the cheat sheet from earlier, with our way added:

Part of the house	Typical WordPress site	Our High-Performance Website
Foundation	PHP running on the server, which needs security updates	Pages built ahead of time. No PHP serving them.
Add-ons	Plugins from many different companies	No plugins
Maintenance crew	Often you, or whoever you hired	Our team, with Website Care & Hosting
Making changes	Often edited right on the live site	Private preview, automatic tests, then a person reviews it
This week	Waiting on the host to patch PHP	Not directly exposed to these PHP flaws

Here's what's underneath, in a little more detail:

• Pages are built ahead of time and delivered from a global network. No engine on the server cooking each page on the spot.
• No plugins. No stack of add-ons from a dozen different companies that each need their own updates.
• Every change gets a checkup before it goes live. Each change gets a private preview link and automatic tests, then a person reviews it. Nothing goes straight to your live site.
• One team owns the foundation. With our Website Care & Hosting ($155 a month), hosting, updates and fixes are our job, not yours.

Now the honest part, because you deserve it: no website is unhackable. Our sites still have moving parts (the hosting platform, the form that sends you leads, the code libraries we build with) and those get updates too. The difference is fewer parts, fewer doors, and people whose whole job is keeping them locked.

A fast, reliable website also gives visitors a better experience and supports everything else you do to get found online. If you want to see what showing up better could be worth to your business, try our free SEO ROI calculator, or see how our SEO plans build on a site like this.

The bottom line

This week was a fire drill for the whole internet. Most sites made it through because hosting companies scrambled. But "my host probably handled it" isn't a security plan.

So here's your homework, and it takes five minutes: find out what your website is built on, and ask your host if they applied Wednesday's fix. If you don't love the answer, or you don't get one, let's talk about a High-Performance Website.

The best time to plant a tree was 20 years ago. The second-best time is now. Be kind to your future business.

Footnotes

1. Patchstack, "Major security alert: PHP vulnerable to critical RCE, attacks ongoing", October 21, 2026 (live timeline, includes reporting from NOS and Wiz Research). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

2. GoDaddy, "Important PHP security update: What website owners need to do", updated October 21, 2026. ↩ ↩²

3. Newsweek, "Critical PHP Flaws Threaten Millions of Websites in New AI Security Test", October 21, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

4. Insurance Business UK, "UK councils and Met Police among sites pulled offline after NCSC alert", October 2026. ↩ ↩²

5. heise online, "php2shell: Updates roll out as websites go offline and attacks begin", October 2026. ↩ ↩² ↩³

6. W3Techs, "Usage statistics of PHP for websites", October 22, 2026. ↩ ↩²

7. W3Techs, "Usage statistics of content management systems", October 22, 2026. ↩

8. W3Techs, "Usage statistics of PHP Version 8 for websites", October 22, 2026. ↩

9. Wiz Research, "Exploitation in the Wild of wp2shell". ↩